According to [1], running a 51% attack for an hour is incredibly cheap for most currencies. Why doesn't this happen more often, or is running the attack for an hour not a long enough time frame to double spend?
I think it's just not worth the time. What do you do when you've successfully run a 51% attack? You go on an exchange and double spend the money, which means you have to maintain the 51% attack for longer than min # of confirmations for this currency on said exchange. And even after that, most exchanges (in NA at least, can't say much about intl) require KYC.
Exactly, it's not worth the time. And once the attack is underway, it'll be detected and everyone can simply increase the number of confirmations needed before finalising.
Increasing the number of confirmations is easy but it also slows down everything. People don't want to have to wait for days for their transactions to be accepted.
If I understand correctly this attack managed to reorganize hundreds of blocks. That's a lot of time to wait for confirmations.
It's really obvious once the new chain is broadcasted. "Honest" miners switch over to mine on the deepest chain as soon as they become aware of it. It's very rare to even see a 2-block conflict. When you see a large N-block conflict then it's obvious there's a 51% attack going on.
But isn't the point of the whole thing that you do not broadcast it until after you are done? So yes, it's obvious in hindsight, but the damage will be done.
[1] https://www.crypto51.app/