I need to clarify one important point:
Bitcoin, the way Satoshi Nakamoto designed it originally, was not supposed to face such a situation in which nodes and miners are almost two different, sometimes conflicting, groups of actors. Nodes and miners started to deviate only after the invention of pools and SHA256 ASICs, which both happened when there was no Satoshi anymore. So, it is not a normal or pre-planned situation, it has simply happened without getting any proper treatment. Bitcoin was great enough to absorb these events and adopt, yet it is very important to recognize both pools and ASICs as major open topics to be addressed.

Back to Op's question about the roles of each group in securing the network against 50%+1 attack:
It is hardly considered an 'attack' for an entity to put her hands on such a majority of hash power, unless s/he attempts a re-org for scamming specific victim(s) who didn't have enough patience to wait for a safe number of confirmations before accepting the attacker's payment as being finalized and releasing their assets.
Actually, an in-depth analysis of the problem could prove that there is always a threshold of safety for a receiver of bitcoin transaction, while this threshold is proportional to the total value of transactions that the sender is trying to convince the user to accept as being legitimate and finalized.

In practice, users adjust this threshold by applying factors derived from real-world information about the costs of re-org attempts, it is why even the most cautious users do accept payments in bitcoin after few confirmations, nowadays, and it is why bitcoin is the king in cryptocurrency for the time being, considered to be 'the most secure', it is VERY hard, hence costly, to run a scamming double-spend scheme by re-writing just a handful of blocks.

Obviously, non-mining Bitcoin nodes have nothing to do  in terms of 'helping' the victim(s) because they experience the hypothetical re-org event all the same as the victim(s), though they are not scammed in a double-spend scheme.

Now, let's take a closer look:
As I said, in Bitcoin, users are safe against double-spend even though there could be an evil spender with unlimited access to huge hash powers, but doesn't it look odd or somehow counterintuitive or at least surprising?
Sure it is, and it is what makes Bitcoin the invention of the century as the ultimate solution to double-spending problem in cryptocurrencies. Bitcoin is absolutely safe against double-spending attack, it has always been and will be existentially double-spend proof, forever.

The rest of OP's security concerns about malicious counter-protocol blocks, with malicious txns injected in, are irrelevant because they are not categorically security issues. Full nodes are sovereign entities that follow the protocol and consensus rules independently, comparing work load of competing chains takes effect AFTER imposing consensus rules, chains have to pass the consensus test to be qualified for the race, although the client software does it somehow in a reverse order, ultimately it is what the code does.