It's not an attack vector precisely because of that. Another scenario is the 1% could just then continue mining non-empty blocks from where the attacker left of

It's not an attack vector precisely because of that. Another scenario is the 1% could just then continue mining non-empty blocks from where the attacker left of which would make them the most accurate blockchain with regards to proof of work, this case is even more passive than the hard fork option if you are in sync with the attacker at the time of the attack.