the attack that matters in bitcoin is censorship. The physical and capital costs of a sustained reorg is infeasible, even for nation States. The real risk is censorship, and if hostile miners do not mine transactions, they don't collect the fees. if the attack is mining transactions to collect fees, they are not hostile, because that is what miners do.