If they have the power to do that, but choose not to, then we are still somewhat stuck in terms of trusting they will act in the best interests of their investment (and the community).

Flies always come to honey. It's impossible for whales' stake to remain honest, because if they do not grab the power vacuum, then someone more ruthless will step into their place and dilute their stake. I explained one possible attack mechanism in my blog for the most ruthless to take over the chain. This is a inviolable fact of political economics.

What you do not understand is they are already doing the attacks, but the attacks are obfuscated such as using socket puppets to hide how they are siphoning the minted STEEM to themselves and taking over the blockchain even more so than is evident from your analysis. Of course no one can prove or disprove it, because that is the nature of sockpuppet (i.e. Sybil) attack on the resources.

Until there are a lot of developers working on the STEEM blockchain outside of the Steemit company, they do represent some level of systemic risk

It is forever a risk and a reality, and no amount of diversity of developers will change it, because the power-law distribution of wealth and resources is inviolable. There is plenty of research on this. Google can help you find it.

At one point there was a proposal to technically allow accounts to permanently forfeit their right to vote for witnesses.

That would not mitigate the problem because power-law distribution is fractal, meaning it will reappear in the remaining stake that was not forfeited. Period.

Also presumably the stake when spent would lose that restriction, otherwise fungibility is destroyed. So permanent revocation of voting rights is impossible (or foolish).