Then why the merchant would accept it?
It is released and confirmed. If necessary the attacker himself provides the first confirmation, which connects it to a recent tip. The transaction looks legit.
But the cumulative weight of that tx is not so big, so why the merchant should accept it?