CTV is not as powerful as you think. It is just checking a hash. The attack you're thinking about requires what they call "recursive covenants".

When you create a CTV spend you must already know all the possible future spends and you can't fall into the same system. It's a pretty dumb change, and pretty safe, easy to reason about. Even though it is super simple it has some nice use cases.