If it's to someone's advantage then they'll try it. The thing that balances it out is that it's to every single other person's humongous disadvantage to permit it to happen. So they won't.
I think we can all agree that users wouldn't
fork to roll back the chain. That would never happen and it wasn't the issue here.
The issue is this: What would users do if miners orphaned the chain with the "hack" transaction and kept all other transactions intact on a parallel branch? This isn't a fork and node operators have no power to stop it since both chains are valid.
The only way users could reverse such a block reorg is by hard forking to roll back the chain and then hard-coding the "hack" transaction into the fork. Wouldn't that be the ultimate irony?