Correct, once final a transaction can not be undone. Transactions sit in a pending state until they are final, and that state duration is dependent on a number of variables. Transaction that are in this state for too long are rejected.
So, how does this deal with a network split? I have yet to see any consensus proposal which is truly forkless without the ledger producing nodes being set in concrete, like they are in ripple.
I put it to you that forks are inevitable unless the nodes producing the ledger are a fixed set.
The ledger is append only, honest nodes either all agree to commit a change, or do not, so between honest nodes there are no network splits.
With dishonest nodes, you can not enforce that they are committing the correct data or not, or if their ledger is in the correct state. Dishonest nodes may be doing all kinds of manipulation with the ledger they hold, yet still be actively participating in the protocol.
We simply do not care if dishonest nodes have a different state of ledger or not, because assuming that bad actors do not exceed (n/3)-1, we can be sure that we can guard against it.
All the honest nodes are in a state of correctness, and will not commit any actions presented by dishonest nodes that attempt to subvert that correctness, because they will all arrive at the same result when presented with that data. Should some data from a dishonest node be accepted, then all honest nodes will retain the state of correctness, because they will all have committed the change from the bad actor.
The dishonest node can present changes to historical data all it likes, all of the honest nodes will refuse to make the change because it violates the append only rule, even if greater than (n/3)-1 are telling it do so and honest nodes are in the minority.