There are limitations on what can be changed "in secret" in that if the consensus rules are changed, other entities in the ecosystem (exchanges, seeds, full nodes, etc.) have go "agree" to the changes and apply them to their nodes too, otherwise the witnesses will go off on their own and leave everyone else behind. The code changes that were made today did not change any consensus rules.

Witnesses always have the ability to "ignore" transactions. In 99% of the cases, if they do this - it is a very good way to get voted out by the stakeholders and replaced by new witnesses. That is esentially what all of the (other) top witnesses are doing with this "soft fork" - agreeing to ignore a set of transactions from certain accounts.

Ultimately, DPoS is a stake based governance system. Stakeholders are the ones who choose who to vote in, and witnesses who do not align with the interests of the stakeholders typically get voted out. If the stakeholders are not OK with the witnesses ignoring certain transactions, then they 100% have the ability to vote in witnesses who won't ignore them.

What I suspect you will find though is that in this case the witnesses do have the support from a large majority of our stakeholders. At least that's my read on it.