That’s why you need 6 blocks to consider a transaction as valid. If they can keep the attack for long periods of time, they render your settlements useless.