In the malicious re-org scenario, it's the actual behavior (not building on blocks that are valid) that's nefarious, regardless of who does it. This is when you want social slashing. The reason is that the protocol doesn't have the "meta awareness" to self-correct.