It is mentioned in Tangle's white paper (technology behind IOTA) that
From the above discussion it is important to recognize that the inequality λ > μ should be true for the system to be secure. In other words, the input flow of “honest” transactions should be large compared to the attacker’s computational power.
For this line, refer to second last paragraph, page 19 in here.
It is also mentioned that,
The number of nonces that one needs to check in order to find a suitable hash for issuing a transaction is not unreasonably large. On average, it is around 38.
For this line, refer to last paragraph, page 26 in here.
The TPS or transactions per second in IOTA is ~12 as of today.
Check live TPS at Tangle Live.
Combining all three points, my question is that
Anybody with reasonable amount of power can easily check 38 nonces to produce transactions reasonably larger than the current Transaction Per Second in IOTA. So, does this mean that double spending is possible on IOTA or am I missing something?