Attempting to directly perform a 51% attack is unrealistic even for a state level adversary.

The most likely scenario is for them to bribe pool operators / big miners to censor certain transactions or just in general disrupt the network.