It actually has to be costly, not difficult. And not wasteful.

To see this, note that all POW and POS chains have "difficulty" functions that are actually just cost functions in external markets (hashpower or capital). What secures the difficulty of the attack in all casds is the supply curve of some block production factor in an external market.