In a blockchain there are miner nodes and validator nodes. The job of a validator node is to validate transactions to be included in the mempool, broadcast or propagate the transaction for the other nodes and then to validate the candidate blocks created by the miner nodes. So can a validator node be maliciously programmed and deployed on the network by an attacker to accept/validate tampered transactions(favoring the attacker such as by double spending) generated by the attacker? If yes then what happens if the attacker owns more than 50% of the nodes? (not >50% of the total hash power but >50% of the total validator nodes)
The number of nodes that perform validation is completely irrelevant, because there is no vote.
Validating nodes validate everything independently; they all have their own mempool with transactions they believe are valid. Who cares that an attacker spins up a gazillion nodes? It won't make your node (which you're presumably using to validate your payments, if any) accept these invalid things.