Also: the attacker is necessarily a miner. What differentiates a "good" miner from an attacker?

I think my answer is that an attacker could only be someone who intends to cause chaos by constant reorgs.