A dozen genuinely independent witnesses is better than the vast majority of blockchains out there.
"Temporarily halting" spam transactions is not the same as taking funds or adjusting account balances. Neither technically and certainly in getting all the witnesses to agree.
Hive is also controlled by 20 witnesses and if all got together to steal funds they could do so as Justin Sun managed with his attack.
But this is extremely unlikely because it would destroy the value of the HIVE token in which the witnesses are heavily invested.
Only BTC is truely secure for very large amounts of value, but HIVE and Hive Engine are plenty secure enough for the values they handle and much more.
Yes fair points all round - this applies to any chain where a handful of actors control the stake! And granted about self interest keeping people honest!