It might be difficult for you or I to profit from double spend, but remember, the threat profile is entire countries, and if any of the heavy-hitters wanted to kill BTC the logistics of conducting a big gnarly double-spend would barely register on their existing cyber budgets.
Back in the day, these scenarios were fanciful because crypto was small-league and the viable threats were big-league. Since then, crypto made it to the big leagues, but I don't think it ever became capable of handling big-league threats. At some point it will have to reckon with that.