Bitcoin's protocol doesn't prevent a double-spend for a 'short' amount of time after payment, it just guarantees that, eventually*, exactly one of those spends would be seen and counted as valid by all compliant nodes (as long as at least 51% of the network is compliant nodes).
But nothing prevents a minority attacker from branching the chain with their own alternate history at any point, although if they did it to a 'historical' block - one deep behind in the chain - then they're doomed from the start, they could never build an alternate chain longer with the main network racing them. Their only hope is waiting for a spend to become in a valid block then immediately start another branch with a double spend, hoping they could convince enough of the network to accept their version of the blockchain where the second double spend is actually the legit one. This gets harder and harder the more blocks build on the main branch, if 5 or 6 blocks build on a block, it's pretty much impossible for all intents and purposes to invalidate that block. (Unless, again, the attacker cares enough to secure computing firepower greater than or equal to 51% of the overall network)
*: "Eventually" is a probalistic statment, theoritically an alien super computer with unimaginable power could rewrite the whole blockchain from 2009 till now in the time it takes one of ours to boot, the blockchain protocol constantly adjusts a parameter that makes mining a valid block always takes, on average, 10 minutes. Assuming no sudden computing advances, this will always compensates for increases in gradual computing power such that you always need the majority's support for dictating what's the longest branch.