Also, and I could be mistaken, my understanding is the double spend can only happen when the person trying to double spend controls the private/public key to the coins. Normally when you deposit crypto in an exchange (or this hypothetical Paypal wallet) you lose that access and your balance is just a row in a database while "your" coins are swept into a large hot/cold wallet run by the service you are depositing into.