It's no doubt a possibility but if an exchange does instigate double spends, then it would only be shooting itself in the foot. They'd lose out on potential revenue if trading a coin that is compromised and if their actions were discovered, it would be game over for their entire business as no nobody would trust them.
It's only likely to happen with smaller coins and a lot of newer PoS coins have automatic checkpointing set up which is a counter measure to this kind of attack, although this doesn't rule out the possibility.
i would have thought about a scenario too, where the exchange keeps operating like normal and maybe
years after they closed down carry out the attack, when the coin was adopted by the masses already and could carry marketcap in the billions potentially.
That's a good reason to say: pos is not fit for massadoption right now. It works maybe for smaller marketcap, but multibillion-dollar-cap is too high risk.
note: i am holding myself pos-coins right now
this just came to my mind when reading the vericointhread today