A double spend attack requires a specific unsafe action by the receiving end of the transaction. As long as the receiver does not accept an unconfirmed transaction they cannot be a victim to it.

Even confirmed transactions aren't safe. The blockchain can be retroactively edited by anyone with enough hashing power: the only thing they need to do is to generate a longer alternative chain than the current public one.

There’s also plenty of fun things you can do like exclude some particular exchange from being able to commit to the blockchain. As in sorry Coinbase your transactions are no longer welcome and there’s effectively no way for them to directly fight back.

The only way around that is to constantly spend more money on hashing power than any attacker, but that cost is effectively unbound. Trying to stop some random billionaire doing it for the lulz means sky high transaction fees forever. No problem for an actual currency in widespread use, but a serious issue for a hypothetical store of value which needs constant investment just to break even.