[hudon]

The most recent bug (that we know of) that allowed double-spend was in production for over a year [0] (~Sept 2017 to ~Sept 2018). I don't think it is possible to accurately determine the probability of this bug being exploited (because you are right, it is "all probabilistic"), but this inability to determine the probabilities is precisely why PoW is security theatre. PoW has always been painted as a mathematical model of the security of the system (see featured article), but in reality this model is not accounting for the much more realistic attack vectors. Hence it fails to be an accurate model.

If you're just saying that PoW isn't painting the whole picture, I agree with you.

[0] https://bitcoincore.org/en/2018/09/20/notice/