The gap is pretty large and "therefore" is not enough here. The fact that we don't observe such attacks hints that you are plain wrong.
I'm not sure what gap you are referring to?
A double spend in POS has a constant cost proportional to the amount of stake you own.
Yes, for PoS the security is exponential to amount of users
With PoS/PoI/DPoS a sybil attack can come without any notice and with potentially much cheaper costs. (No, an attacker need not have to "buy" coins to attack, They can create an exchange/bank that pays interest/dividends to corner a good chunk of coins 5-30% needed depending upon the algo, Or they can create a popular wallet with a backdoor, Or they can compromise several large bagholders computers, Or a few large holders could short and attack their own coin, ect..)