IMO if someone attempt to make double-spend attack, most likely they would try to fool multiple parties and using multiple identity (e.g. deposit smaller amount of Bitcoin with multiple account on exchange rather than make a huge Bitcoin deposit to smooth the attack).
splitting millions of dollars into smaller sizes is so hard and it also needs to ge as many people involved as the victims. not only finding that many victims accepting such still large amounts is hard but also it means more legal action against the attacker. nowadays with all tracking that is done specially in exchanges it is not easy to get away with that kind of scam.