The attack you're describing is analogous to 50%+1 attack.
The chain will fork, and after Bitcoin + Bitcoin Cash and Ethereum Classic + Ethereum it's reasonable to assume both versions will co-exist to some degree.
Yeah, I think that is the right way to think about it. I had always considered that in terms of mining power, not in term s of network control, but it is effectively the same incentives and consequences, just with different players.