Why can a 51% attacker not change the block reward? It is said that in the case of an attacker having a sustained 51% power, the attack still cannot change the block reward. Why?

My naive understanding is that, since consensus is controlled by the attacker, this suffices to push through a protocol change that changes the reward.

The main branch is the only one that can still confirm transactions, so clients 
would need to update their software to stay on this (malicious) main branch.
Even you have 51% of hashpower you can not change the software on other computers to accept your blocks.