Regarding "stealing a token": remember that even in the case a block gets replaced by another, both have to be valid blocks, containing valid transactions. This is why the most famous attack is a just a "double spend attack" and not any kind of money steal. Problems with tokens, that is, transactions that run arbitrary code, happen due to bugs in such code, not because of fundamental issues with the protocol.
Transactions are signed using public key cryptography. A miner can't modify a transaction present in the pool or make it up. Transactions need to be correct in order to be part of blocks.
This is the bit I don't understand. A block is a set of transaction information which is chosen by the miner/staker. What's stopping them from just making it up? It will still be a valid transaction.
Edit: BTW, isn't this what stealing a token would be?
> overpowering and replacing some of the blocks at the top of the chain.