I'm not sure how easy it would be for exchanges to implement variable confirmations depending on the amount transferred, but I would say that what you suggest is a very reasonable way to limit the risk of suffering such an attack. I would say that especially exchanges that support fringe coins would better look into something like that. Even if the exchange's potential loss is only a couple hundred or thousand dollars, it's worth doing in my opinion, even if only to avoid the technical or legal hassle that would otherwise follow.

I would say that most (other) fringe coins are not as easily attacked as ETC was. They have very illiquid markets, and you cannot really sell a significant amount of them before you basically just deplete the order books. And merchants are typically not accepting anything other than the major coins either. I guess ETC was still riding along on its partially shared name/history with its bigger brother.

Eventually, some more details on the double spend transactions might shed some light on who suffered a loss in this case. It might be an exchange, but most of them require KYC nowadays (so it becomes hard to get away with).