Is that enough?
Yes. If you can produce all the revised blocks plus produce new blocks faster than all other miners combined can produce just new blocks, then you can force a blockchain reorganisation.
the malicious user has to change those blocks for every single node (or at least 51% of the network).
That’s the much easier part. You make your new block data available and other nodes will collect it and distribute it for you. Since all nodes have to allow for blockchain reorganisations, which are relatively routine though usually very small in scale, the mechanism is part of the Bitcoin network.
The much misunderstood 51% figure is concerning the total hashing power of all active miners in the network, it isn’t anything to do with the number of nodes.