Because the main chain will always be the one with the most nodes to be executed. Because this is the one that miners want to follow in order to be able to maintain the current gains.
Ehhhhh... by tomorrow anyone with an amazon and google cloud account and a bit of money to blow could spin up more nodes than the current entire network following whatever rules they want.
Of course, with no user behind these nodes they're irrelevant, and nothing in bitcoin works by counting nodes. So attackers don't bother, but they easily could if it mattered.