Flash loans can totally be (and are) attacked like you describe. In fact much of DeFi can be frontrun. Most commonly it’s large trades to AMMs, where the original buyer ends up getting significantly more slippage than they expected.

The future is likely private smart contracts like Secret (https://scrt.network/)in which the contract’s internal state and the function calls are entirely obscured using sMPC or by leveraging SGX enclaves. This makes it impossible to frontrun in most cases.

Whether an unauditable financial system is a good thing or bad thing is still up for debate.