Nodes will follow the chain with the most valid accumulated work. The whole point of a 51% attack is that a malicious miner can produce blocks faster than the rest of the network. So while the rest of the network mines the original transaction and x number of blocks on top of it, the 51% attacker can mine an alternate chain in secret which double spends the coins in the original transaction back to themselves and x+1 number of blocks on top of it. Once you have released the goods or whatever, the 51% attacker can then broadcast their alternate chain they were mining in secret. Assuming that this chain remains consensus valid (and there is no reason it wouldn't be), then nodes will immediately switch to this chain upon learning about it, since it is longer than the honest chain and therefore has more accumulated work. At that point the original transaction and all its confirmations disappear from the network, and are replaced by the double spend transaction.

Nodes do not police which chains are "honest" or "dishonest", and really, have no way of making that judgement. They simply follow the valid chain with the most accumulated work.