Indeed. I was also surprised to find this out given how popular Electrum is. The code is here: https://github.com/spesmilo/electrum/blob/master/lib/blockch... and https://github.com/spesmilo/electrum/blob/master/lib/blockch...

One could run a modified Electrum server that sends a long chain at low difficulty and double spend Electrum users.