The actual users of the system have significant power, if they (could) choose to use it.  There are "chicken" effects though.  They can impose costs on the other participants but using those options harms themselves.  If the cost of inaction is greater than the costs of action, then the chicken effects go away.

In the extreme, they could move away from decentralisation and the concept of miners and have a centralised checkpointing system.  This would be a bankrupting cost to miners but at the cost to the users of the decentralised nature of the system.

At a lower extreme, they could change the mining hash function.  This would devalue all of the miner's investments.  A whole new program of ASIC investments would have to happen and the new miners would be significantly different.  It would also establish that merchants and users are not to be ignored.  On the other hand, bankrupting miners would make it harder to convince new miners to make the actual investments in ASICs required to establish security.

As a gesture, if merchants and exchanges wanted to get their "seat" at the table, they could create a representative group that insists on a trivial soft fork.  For example, they could say that they will not accept any block from block N to block N + 5000 that doesn't have a specific bit set in the version.

Miners have an advantage where they can say that they have the majority of the hashing power.  As part of the public action problem that merchants face, there is no equivalent metric.