It depends on what type of malicious activity we are talking about.
If we are talking about a malicious actor with the intent to destroy the Bitcoin system at any cost, then you are correct. The entity with more than 50% of the global hashpower can do that regardless of what the nodes can or can't enforce. This would be a VERY expensive attack, but is theoretically possible.
On the other hand, if we are talking about a malicious actor with the intent to profit from their power, then the entity with more than 50% of the global hash power is MUCH more limited in what they can accomplish. Any action that would destroy trust in the system as a whole would simultaneously destroy their ability to profit from it.