Why is ECDSA secure?
We don't. As far as I know there is no proof of security for ECDSA in any model. There is, however, almost 2 decades of usage in the wild, including by Bitcoin and Ethereum, which would allow any would-be attacker to make a tremendous amount of profit. The fact that this appears to have never happened is good empirical evidence for its security.

I've also spent a while exploring this problem. I believe that if you model the mapping from a curvepoint to its x-coordinate as a random oracle function you can use a forking lemma argument to prove the signature secure. This is unrealistic but it implies that any forger would need to find a meaningful relationship between points and their x-coordinates, and it's hard to imagine such a thing that wouldn't also solve the discrete log problem.