Energy as the base unit of Bitcoin's value is the correct framework. Hashrate is a proxy. Price is a proxy. Energy expenditure is the ground truth.
The reason it's hard to quantify is the same reason it's valuable: you can't fake energy consumption. Every joule spent on mining is a joule that can't be spent on anything else. That opportunity cost IS the security model.