If my understanding is correct here, confirmed transactions are secure against sybil attacks because SPV still validates each block's difficulty?