I came across this website which is from a BU node "detecting" double spends on the BCH chain. https://doublespend.cash/224.html#respends
Since there is no true provable timestamp on transactions the node can only use information on when it received the transaction into the mempool from the network. Presumably, the first one received is the original? But with network delays, this again is not provable.
In any case - you can see multiple examples of double spends, several of which are successful by just bumping the fee. So if this was zero conf, those funds are not actually confirmed, even though a user of the zero conf wallet would think they are.
An example:
With the recent purge in the price action hopefully new users will be able to get Bitcoin cheaper and stay away from these insecure imitations.