This kind of analysis are vulnerabilities in the consensus sense. You can think of a state actors not caring about the investment done but about the harm they can do.
My only point is that >50% attacks by the people involved are purely theoretical. Attacks by almost any state are the end of your project. A billion dollars is enough to DDoS pretty much everything.
Then you argued about the bounds and if they were theoretical or not which was not the central point of the argument and we can choose another issue to illustrate our central point. I think we can argue if it is theoretical or not ad infinitum.
So, to push forward my central argument I will again say: we need to check beyond the cryptography. Not only that, I will tell you: stay tuned because a new security finding with Bitcoin will be published soon.