Regarding centralization of mining power in mining pools

Hello,

Just recently got into BTC. I read The Bitcoin Standard, and I agree with most of the picture and the downgrade of society, higher time preference, etc. And recently I read Mastering the Bitcoin Blockchain by Andreas Antonopoulos.

At one point, specifically page 288 in the "Hashrate Attacks" subsection, he mentions the very plausible vulnerability of mining pool operators being open to double spend coins. Generally whenever a vulnerability is pointed out it would come accompanied by the specific BIP# that led to the fix or patch of the problem, but in this scenario it doesn't happen. The vulnerability is simply pointed out. Essentially saying that it is possible for the operators of mining pools to double spend coins as long as they do it at a reasonably low volume to not draw much attention... being that the transactions on a block are hashed on the aggregate (merkle root) it would be oddly difficult to find, right? Or am I missing something...