Why would people sell rather than fork to a version of the network where those ETH did not exist? One of the benefits of POS is that when you fork away from a malicious actor, they have to start over from the beginning while in POW, they can just point their hardware to your new chain unless you change the mining algorithm and screw over all the other miners.

This is exactly what happened with Ethereum in the early days when a bad actor was able to exploit a third-party contract to the tune of 5% of all ETH.

The Ethereum everyone talks about today is the fork, due to the Ethereum Foundation which owns the trademark leading the fork.

The Ethereum blockchain with the unaltered history is called Ethereum Classic

https://en.wikipedia.org/wiki/Ethereum_Classic#The_DAO_bailo...

Note that the way this fork was pulled off was very ad-hoc.

Ethereum devs were unable to create a legitimate transaction reverting the DAO funds because they do not have access to the hackers' private key. The reversion was done with a "surgical state change" hardcoded into the client itself.

Think of it this way, if another company announces they're planning to buy a publicly traded company, what happens to the value of the shares?

The price goes up, you've just made it more expensive for yourself to take over the network.

If you were to attempt to take over you'd be better to do so in silence. However, it would be hard to hide that kind of control and wealth when every information on the network is publicly available.

In a public company, though, having been taken over doesn't defeat the purpose of the company.

If you're intentionally trying to take things down, sellers have a huge incentive to not be left in the 49% who hold something that's now lost its value - as you say, "as it's become evident you've taken over the network the value of the network is essentially worthless." I think you could get the value to go to worthless well before actually hitting 51% on intent alone, if you're a big enough power.

Why assume a state actor? Given the sorry state of DeFi contract security, it's far more likely that an enterprising hacker can gain a dominant staking position by pillaging and then staking ETH from buggy contracts.