How is he creating 1 million valid validators?
The validators at time = 1 decide the validators for time = 2. He needs to somehow control the keys for 1 million validators at some point in time for this to be possible.
It is possible if they are buying the old keys from people who have stopped validating (although still difficult). To protect against this Ethereum uses weak subjectivity. https://notes.ethereum.org/@adiasg/weak-subjectvity-eth2
Consensus methods are voting models and PoW and PoS are just the methods used to decide who gets to vote.
PoW says anyone who is able to produce a block with a hash containing a certain number of leading 0's gets to vote.
PoS says anyone who has locked up a certain amount of stake gets a random chance to vote.
They are just ways to limit the number of voters so people can't just set up thousands of virtual nodes to overload the vote. They are sybil protection methods.
The rewards and penalties are just further incentives to keep the voters aligned with the underlying protocol and to not do things like double vote or post empty blocks. Ethereum's PoS slashes users who double vote. With PoW it costs electricity to even vote so it's difficult to double vote in the first place.