they could implement a new version of the bitcoin software.
That isn't my understanding at all. They could force a fork in the blockchain but they couldn't do what you said and "implement a new version of the bitcoin software" to my knowledge. Double spends are possible in this scenario, but when the bitcoin community figures out it happened (it wouldn't take long) it probably wouldn't be a pretty reaction.
I would imagine it would involve a mandatory client update with redownload of the blockchain for the non-private fork, and contacting of parties possibly influenced by the intentional attempts at doublespending before it got too far.
More likely, instead of doublespending the entity would abuse their hashing power to be a "gatekeeper" of transactions and blocks. If this was done by a large pool they could for example, deny other pools from processing valid blocks to try and encourage even more people to mine on their pool. This was something that was being discussed a lot last year when the GHash.IO pool was getting near the 50% mark, and people were monitoring what they were doing on the network.
If the problem persists the community could change the verification system of transactions to another type of PoW, whether it be SHA-256, Scrypt, X11, X12, X13, Scrypt-N, Scrypt-ChaCha, Groestl, Keccak, NIST5 or something else...or abandon PoW in favor of PoS, the new PoS system rat4 is building, a PoS/PoW hybrid or some other alternative I'm not aware of that is out or being worked on. There are endless options if it becomes a serious problem, and more are being created all the time. These are pretty extreme solutions to a couple example problems that I've given, and would be damaging to the community around that coin, but I'm just throwing them out as possible answers. There are people around with I'm sure far better solutions than what I just pitched to you.
There are an amazing amount of talented people working on cryptocurrencies who love to field solutions out to the possible problems which could potentially come up, no matter how minuscule the probability.