It would be nice if there were a way of solving the double-spending problem that would make all attacks infeasible. But since there isn't, we need to make do with the options we have: to place trust in either a pre-chosen authority, or a defined majority we assume to be trustworthy.
Not all the tools we have for maintaining security are as good as public key encryption or symmetric encryption. In the world of bricks and mortar, $10 million buys you a lot of criminal clout. Is a safe deposit box safe against a determined attacker with that budget? Are all employees immune to million dollar bribes?
The law attempts to redress imbalances by making it difficult to get away with circumventing security to perpetrate financial crimes. The problem is not so much stealing from a bank, but getting away with it after the fact. The same problem applies to bitcoin if you want to execute a 51% attack; double-spending is financial fraud, after all.
Buying up $10 million worth of ASICs is relatively straightforward, but doing so in a way that can't be traced back to you is substantially more difficult. As well as the problem of trying to run that amount of hardware in secret, without a paper-trail, you'll also have problems in trying to convert any profits you make from the scheme back into fiat currency.
If one merely wanted to demonstrate the attack without profitting from it, then one could double-spend a small amount between accounts you own, in the same way that one could demonstrate an attack on a safe by buying one and then drilling into it. But that doesn't change the fact that there's a big difference between circumventing security, and illegally profitting from it without consequences.
