so, the DAO contract is the only authority, and everything is on the blockchain, except when the collective decides it's not? you say "nothing changes", but something obviously would - "the attacker" would lose their money. and not because any smart contract decided so, but rather >1/2 of the involved participants.

of course, he's a thief and should not get the money, but maybe the DAO was flying a bit too high too quickly.