[VMG]

Yup, this is indeed a weakness of the current PoW system.

People often misunderstand it to be completely secure if no attacker has more than 50% hashrate.

In reality (and as described in the whitepaper), the 51% limit is described as the state where no number of confirmations is sufficient.

If an attacker has less than 50% hashpower, you can plug in some numbers like hashpower and cost of attack and come up with a number of confirmations that is likely to be secure.