But the security is still good enough, right? As long as the mining expenditure exceeds the potential illicit rewards of a double-spend, it's not profitable to

But the security is still good enough, right? As long as the mining expenditure exceeds the potential illicit rewards of a double-spend, it's not profitable to out-mine the network just to be able to double-spend. So the security of bitcoin should be an all-or-nothing thing: either a 51% attack is profitable, or it's not. It seems to me if there was some way to determine the potential real world reward of a double-spend, Bitcoin could spend exactly the right amount on security: that number + 1. I don't know how to calculate that number. I doubt that Bitcoin mining is matching it precisely because how would it? So it is probably overpaying or underpaying by some amount. So far, Bitcoin appears to have overpaid for security, given that it hasn't been 51%ed. Who knows by how much. Maybe after the next halving, or the one after that, it'll be underpaying?