When it comes to State 2, I doubt that the probability is still X, because the public network has been working all along, while the attacker starts after 1 block ahead and he/she may needs some time to collect transactions.
Transactions are continuously collected. There is no delay for collecting transactions. The "selfish miner" can immediately begin the next block as soon as they complete one.
Even without the collecting time, I still doubt about the probability X. When the "selfish miner" begin the next block, they are not at the same base point as the public network.