Yes, you are correct. New miners should not appear until difficulty recalculation. But given this fact, depending on the intensity of the block mining rate change and how far the next recalculation is, the network could easily notice such changes. I don't just mean they "could", but they probably "would" as well. The world's economy heartbeat h-a-l-v-i-n-g 6 times in a row? (this drama is how critical I think that would be)

I don't know if an effective and immediate response could be taken place, but this sort of monitoring could be anticipated, and also, they would probably store the old chain's backup (just in case). I mean that if they do a rapid decision, it's not necessarily final (although this would cost the whole world economy a lot).

Only newcomers fullnodes, during the racing period, couldn't know which chain actually appeared first, but all other fullnodes and miners do know which one did, and that the alternative chain came at once and out of nowhere. This is an easy target for an "temporary chain force-choosing" algorithm. And again, this could be coded before the attack -try itself.

So I don't mean that this surely would be a "forced" (rushed) code-fork. On the other hand, without such a thing, everyone would enter a rushed data-fork, which probably will also be viewed as something risky and some costs may be applied (prepared in antecedence).