No, the economic majority[1] also matters. If the miners decided to hardfork bitcoin and double their mining rewards, and the non-mining users did not support this change, their fork would fail because nobody would accept their coins. This is exactly what happened to the segwit2x fork[2], which was arguably less contentious than doubling mining rewards.
Even if all of the miners made a change, if it doesn't align with the public perception, the value will vanish.
The economic majority is basically tied directly to this. It's not only the holders of btc that decide the value. The more it aligns with what the public wants from a parallel currency, the larger the want, and the larger the economic majority. If the miners disalign with the hodlers, it dies. If the miners and hodlers conspire, it still dies.
In a hard fork[0], blocks produced by the newer version will not be accepted as valid by the older version (e.g. increase of block sizes, changes in rewards or additions of new opcodes). This will result in a split of the blockchain, where old and new nodes operate on two concurrent diverging chains. You can think of it as a git fork. A hard fork essentially requires all nodes to upgrade.
Hard forks are generally activated by first adding the functionality without activating it but signalling for compatibility, only actually enabling the protocol change once a subset of nodes have signalled support.
In a soft fork[1], blocks produced by the older version can be deemed invalid by the newer version - otherwise the two are compatible. This means that users don't strictly need to upgrade to participate, only miners do.
So TL;DR, if BTC Core developers released a hard fork, it would only go into effect once it reached majority support among miners. In practice, users and other stakeholders (most notably exchanges) also have an important practical voice in which chain is deemed the canonical one, in case of a split.
So it doesn't really matter who can push code to what repo. It only matters who can organise the majority of computational power.
I'm not saying it's not vulnerable, but I am saying that investing in taking over btc in order to enrich yourself will by its nature backfire, and that it's not really vulnerable to code change in any way like a centralised system.