Will miners actually be able to react when the duration of the attack from start to finish is well under 13 seconds? They weren't able to in the prior hack linked above. Or does Proof of Work take far longer for voting?
In bitcoin, the timings and counts of blocks required for "safety" were designed deliberately.
[Edited paragraph to make it clearer] So the 10 minute timing of blocks is a tuned value, it's not something plucked out of thin air. It relates to planetwide networking latencies and the probability distribution over time of newly mined blocks and takes account of the change over time (from day 1 to well into the future) of network usage. So you can get 2 blocks mined one second apart but you can also get two blocks mined 1 hour apart. Both of these are extremely unlikely with a 10 minute interval as seen in bitcoin, and the chances are lower as hashrate rises.
The generally accepted 6 blocks confirmation for "large value" transactions caters to the long term network behaviour. In the early days the variations in duration between blocks were large but they tend to reduce as hashrate increases.
The 100 block delay, for spendable coins produced in a mined block, is to allow the network to easily deal with certain kinds of rogue miner behaviour.
But note that proof of work ends with mining in bitcoin. Once you talk about the mechanics of smart contracts, then you are working with a new system that's laid on top of the underlying network (e.g. bitcoin).
This is similar to how the world wide web is a set of mechanics that runs on top of the TCP/IP protocols. HTTPS security for websites is a feature added on top.
So proof of stake in smart contracts is the cause of this kind of problem. It's entirely possible to put a proof of work mechanism into smart contracts and it's possible to program in certain kinds of throttles so that, for example, a newly attained majority share holder is forced to wait a day or a week before they can use their majority position in any way.
So borrowing $1B for 1 day or a week makes the attack uneconomic.
So what this particular attack shows is that people who design these crypto-economic systems are usually complete fuckwits who can't see beyond the end of their nose, rubbing their hands in glee at the profits they can earn with their cool new concept. I cheer along with everyone else when these idiots get hacked, because they deserve to get owned as do their customers.
Governance has been a red flag in these kinds of smart contract systems since day 1.