In the event of a sudden reorganization of the blockchain, several technical considerations would be warranted, reflecting the described scenario.

Waiting for 1000 confirmations before considering a transaction safely received: This depends on your risk tolerance. Historically, six confirmations have been considered secure, but a reorg of 1000 blocks would certainly challenge this assumption. Depending on the perceived risk of further hidden chain mining, waiting for a larger number of confirmations might be prudent, although 1000 might be excessive and hamper practical usability.

As a node runner, rejecting the new tip and keeping tabs on bitcoin-cli getchaintips: You could technically choose to reject the new chain, but this would place you on a fork that might have less mining power and thus be less secure. Regularly checking chain tips and being aware of the state of the network would be a standard best practice. Depending on your view of the legitimacy of the new chain, you might want to take additional steps, such as manually specifying preferred peers that follow the chain you trust.

As a miner, considering pulling out of mining pools or creating new ones: If you suspect that a mining pool was contributing hash power to the secretly mined chain, you would likely want to reevaluate your participation in that pool. Using Stratum V2, which adds more security and transparency, would be a logical step to ensure that your hash power is being used as you intend. Creating new, trusted pools or joining known trustworthy ones could be an appropriate reaction as well.

If 1000 blocks are too many, what if it was 5?: If the reorganization was only 5 blocks, it would be within the realm of what's occasionally seen on the network (though still rare). In this case, a drastic change in behavior, such as waiting for hundreds of confirmations, might not be warranted. However, it might still prompt a review of the network, mining pools, and other factors to ensure that everything is operating as expected.