many variables are missing in the question

for instance if someone made a tx in block 835,000 where network is not working on 835,001
and a mining pool with 30% network hashrate was immediately to go back ONE block(835,000)
and then change it and then play catch up.. the chances to get to over take the network by 835,010(9 blocks of network progress) is different compared to

and a mining pool with 30% network hashrate working on but yet to solve 835,004 and decided to see a tx 3 blocks ago(835,000). to go back 3 blocks and then change it and then play catch up.. the chances to get to over take the network by 835,010(9 blocks of network progress) is different compared to

which is different compared to if someone added a tx in by 835,000
but the malicious pool was already making its own chain since 834,750 but doesnt broadcast it until 835,000