There are many governments around the world who spend that much on one missile, or one plane. We should be designing systems resilient to state attackers who are willing to spend money to ruin your day. While 1-2M ETH may be enough to deter them from attacking, we have evidence that they will spend far more than this to achieve their goals, and many governments do appear to be heading in the direction of “destroy crypto” as one of their goals.
Of course, I cannot say that 9M ETH is enough either, or maybe both are in fact more than enough! However, I don’t think it is as obvious as you imply that we can safely reduce the security budget. Lindy doesn’t apply to these things, because everything will be fine right up until it isn’t, then it is all very very bad all of a sudden.