The 51% attacker doesn't change the rules, he just present a chain with VALID transactions, VALID blocks that follows the rules but it has more work behind it!
I like how handily you insert that "just". 
Yeah, handily, you mean tossing around words and realizing what I've said two hours of pondering even after someone pointing it out
just...
You might not believe it but it really made me thinking a lot, would you have a case against such a miner in court if you sustain financial loss? It might sound like solid case but I wonder if they could go clean with just negligence blaming on not receiving and sending the blocks via a faulty node configuration.
3-4 blocks might not be much but 6-12 hours will wreak havoc on chain for a good while.
But on the other hand, all transactions are visible in the chain and any such thing would require first a settlement between the two parties in the transactions before the miners, weird one.
Oh, and something to add about the distribution and identifying hashrate location, we had a 4% drop mainly because of Texas shutting down, (officiality acknowledge by large farms), all those farms are making the bulk of Foundry, yet Foundry didn't lose significant market share, nor it is gaining right now with hashrate up 6%, so applying tinfoil hat (quadruple layers) on as I said in mining speculation, they might have well over the 30% just mining over other pools undercover!