That is right, you choose wich transaction get confirmed and wich not. As you know an unconfirmed transaction is epic vulnerable to double spend and cannot be trusted.
My bad, I had something else in mind(mining on your side then releasing to the world). The attack you're talking about is so easily avoidable I keep forgetting about it.
If I understand them correctly, those two sentences are still wrong though:
No matter if the owner of the bitcoins wants to send them or not.
You can't force people to send their coins
You can do whatever you want, because you are the majority.
You can't change the protocol, nor steal coins for instance