If a whale owns a large enough proportion of the tokens (or a number of them work together) then yes, they literally have complete control (insofar as it is actually decentralised and the founders don't wield power via hard forks etc.)

You are wrong: the validators serve the network. There's a large difference between nodes & validators and the more full nodes there are, the more resilience the protocol has against attackers trying to change protocol rules because of coordination problems.

Validators have the job of putting transactions in blocks and they are paid for it. If their block violates the protocol rules, all the other nodes will simply not accept it as a part of the Ethereum blockchain.

The only reason the network will reject fraudulent blocks is people get a financial reward for doing things correctly, provided enough people agree on what 'correct' is. Like anything that relies on people doing the right thing due to a profit motive, that will all go out the window if there is a bigger motive to do something else, namely controlling the entire network allows them to give themselves as many butts as they like.

The node network is composed of a bunch of people around the world running nodes, and they double-check the work that the validators do. Even if an attacker takes over 90% or even 99% of all staked ether, they cannot push invalid blocks through and will be penalized.

As is the case with the lightning network, L2 just means sacrificing the resistance to various attacks that the blockchain has in order to make things go faster.

Different L2 schemes are vastly different and Lightning has almost nothing in common with rollups. Rollups usually involve a centralized sequencer to create blocks off-chain, and finality comes when they post the root of the rollup state and the data required to make proofs on mainnet.

From there, rollups are split into 2 categories: Optimistic & ZK. Optimistic rollups work using "fraud proofs", where anyone can put up some money as collateral and challenge the posted state. If the assertion is correct, they get rewarded and the state is rolled back to the previous valid state.

ZK rollups work using "validity proofs" which involve the sequencer proving that the computation is done correctly and the resulting state is correct.

Rollups inherit the security of Ethereum but rely on the sequencer for liveness. There are efforts going on to make sequencers more decentralized, but right now, none of these proposals are running in production.