Why Was the 2,300 Gas Limit Considered a “Safe” Amount against Reentrancy?

The 2,300 gas limit was considered safe because it was enough to execute a minimal fallback function (like logging the event) but historically insufficient to perform a storage write (which is required for a re-entry attack's logic). A storage write operation is expensive in terms of gas.

This limited the malicious contract's ability to execute the necessary logic to call back the vulnerable contract.