No DNSSec is not needed with Namecoin. The mapping from name to IP cannot be forged.
However, DNSSec requires changes to resolver libraries so the domains are actually cryptographically verified.
Namecoin, to be secure, requires similar changes to resolver libraries because nothing in the current resolver libraries actually checks the integrity of the results.
Anyone can run software to verify that a traditional (insecure, no cryptography) nameserver that resolves .bit addresses actually return addresses corresponding to the blockchain.
Thus namecoin name servers can be ensured to not "fool all the people all the time" by having some servers that continuously check the integrity of the results produced by the insecure but backwards compatible nameserver.