So my understanding of Service Workers is that once installed they grant you full control over requests to a domain. If an attacker managed to include their service worker in your site, then for anyone who visited that site the service worker could be installed, and then for example proxy all further requests to the site. Removing the service worker's code from your site would not remove it from the browsers which already had installed it. A nefarious service worker could also hide any warnings you added to your site telling your users to clear their browser data - it could serve its own version of your site making any such changes completely ineffective against compromised users' browsers.
If my understanding of service workers is correct, the only way I can think of mitigating such an attack is to send warnings on other domains. For example, if the attack was on a subdomain you could warn on the main domain, but if the attack was on the main domain you might have to send out an alert on Twitter/FB etc. You may also be able to switch domains (or subdomains) away from the attacked domain, but if anyone whose browser bookmarked the compromised domain then they would remain at risk. Is this assessment correct, or are there ways of disabling a service worker that doesn't want to be disabled?