But it isn't stealing, because those wallets never exist in the new chain. It is simply following the protocol. Now if he sells those coins (if possible but apparently not likely), the new owners are not going to agree to rollback of the block chain.
I assume this is common knowledge right? That is what TW attacks do correct?
That's one way it works. ArtForz introduced it as "A very profitable 51% attack".
Though I don't know if it has been actually done in its full glory. Seems to me that
it would be more common if it were that easy.
Why not more common? TW takes significant resources to execute against a live chain or it will be simply discarded as insufficient difficulty.
Most folks are less keen to exhaust resources in an attempt to destroy things than they are to create them, but it takes all kinds.
This is especially true with the additional resilience added over the years to modern crypto code.
There are a variety of potential effects depending on the peculiarities of the code and network:
Difficulty adjustment manipulation
Network congestion
Coinbase wins and fostering 51% type effects are among these effects, and there may be others.
Forking during such an event compounds the problems, as it reduces the effective mining until they are unified on a good chain, and done spinning resources on verifying that effort.