They already have changed the code, Core v30. There are only ~20k nodes. The evil doers can just: spawn new nodes and use influencers to confuse people. The nodes are very passive and complacent. I agree that if we had millions of nodes actively working on securing the system, that would work as intended.
In the meantime we need to educate people and keep it simple. No changes needed to Bitcoin.