We know that the block's timestamp has to be less than the median time of the last 11 blocks plus 2 hours.
That's not quite right. A block's timestamp has to fall within a range bounded by the median timestamp of the last 11 blocks (plus one second) in the past, to up to 2 hours in the future based on adjusted network time. If the future limit was median time of the last 11 blocks plus 2 hours, as you stated, then we would frequently run in to the problem of miners having fake timestamps, since any time it took more than an hour to find a block we would be outside of that window.
If the 99% of the hash rate disappeared, the difficulty would drop by 25%
It would drop
to 25%. It would drop by 75%.