a) it would be exceedingly hard to properly develop detection algorithms for "malicious reorg" detector
Reorg shows up in the debug output immediately in the client
It's absurdly easy to detect (just look for a chain that's been reliably mined for 6 blocks/1 h and then at 1 h the 7 block fork is detected --> report this to user via pop up)
The likelihood of two totally different chains size max of 6 MB (6 blocks) existing on the network at the same time and both being reported to a vast number of different nodes with neither group of nodes interacting is really, really unlikely