Yup, this is indeed a weakness of the current PoW system. People often misunderstand it to be completely secure if no attacker has more than 50% hashrate. In

Yup, this is indeed a weakness of the current PoW system. People often misunderstand it to be completely secure if no attacker has more than 50% hashrate. In reality (and as described in the whitepaper), the 51% limit is described as the state where no number of confirmations is sufficient. If an attacker has less than 50% hashpower, you can plug in some numbers like hashpower and cost of attack and come up with a number of confirmations that is likely to be secure.