If you wait for confirmation you are fine. But for 0-conf here's an explanation of how a double spend can be done: https://jasonc.me/blog/bitcoin-bip-133-double-spends-bch