All Vcus held by Moss and tokenized (thus all MCO2s) are retired at Verra and Armanino has audited this. The company has been audited by EY. So the risk of double spending is zero indeed (and audited as such)
REDD+ is the most prolific source of voluntary carbon credits (50% of all issuances for 2019-20) and thus there will be more examples of wrongdoing and bad apples. Statistically, though, percentage wise, bad apples are negligible. And the future of the global voluntary market lies on REDD+ : McKinsey estimates that 65% to 85% of future global volumes will come from NBS (thus, from REDD+). And, tech wise, REDD+ projects are the easiest to measure via cold data and satellite imaging. Past "bad apples" happened mostly in a time when imaging was expensive and a lot less accessible than nowadays.
Although Moss' initial positioning has been of acting as an intermediary, the company is beginning to develop its own projects and generation using technology, thus migrating slowly away from the middleman position you mention
Finally, the MCO2 token is listed at the main global exchanges, including Gemini and Coinbase. Thus, the MCO2 would bring Klima the validation of association with a company and project that have gone through the most rigorous due diligence processes out there, and bring the existing high liquidity of current exchanges that offer MCO2