Yes a sustained 51% attack could reverse old transactions. But it would have to be sustained for more than a day. People would notice it and take action to blacklist the attackers.
Theoretically, people would NOT notice that a 51% attack is ongoing.
An attacker would mine on the private chain WITHOUT revealing it, until he decides to do so.
Only at that point in time (when a new longest chain has been broadcasted and transactions of X blocks are mixed up (or just a few of these)) it is obvious that someone has been mining on a private chain with 51%+ of the hashrate.
Additionally there is no 'blacklist'. It doesn't matter WHO shares the block. The network doesn't know from who the block came.
As long it is a valid block, resulting in the longest chain, it is considered to be the (only) valid chain.
This is exactly true, if they were clever enough to keep changing the address the block rewards go to then you might assume it is going to multiple people.
With the pools at the moment, it's like if Bitmain didn't tell you they owned BTC.com and Antpool.com then you'd think those were two different miners, this is probably how a similar style of attack would go. Someone wouldn't say they owned 50%+ of hashpower as another miner maker would obviously want to resolve this (there are three major ones: Bitfury, Bitmain and BW afaik).
