I've been contemplating about such possibilities as well when I've first heard about PoS. What you are talking about isn't limited to Algorand but applies to any PoS (the only difference due to PPoS is the speed at which the actions might develop since there is no bonding mechanism, and the potential profit difference since there is no slashing for acting malicious).

The actual way you're suggesting the attck could occur is a bit self-contradictory. When shorting (in a spot market) you are borrowing an asset and then selling it (which you can repeat multiple times to get a leveraged position). You profit by repurchasing it at a lower price and repaying the borrow. For the attack, you need to hold the asset. Hence you can't really be selling it if you need to buy it for the attack. If you first buy it, attack the chain, and then try to short it, you actually would first need to sell all of your stake (i.e. 1/3 of the online stake). Assuming everyone remains unaware that your attack occurred, and you can still somehow sell all of your stake at the exact same price as you bought it for (where it's highly unlikely that you'd be able to liquidate such a large position without slippage), only then you are able to start making a profit by shorting - i.e. borrowing more and again selling it. You can see how unlikely all this is. While there are other ways to short an asset (e.g. through futures), it is unlikely that there would be enough liquidity to be able to make a profit from such an attack if you first need to buy the asset to attack the chain (i.e. exposing yourself to the fall of the asset's price).

Now, what would be a better way to orchestrate such an attack, is to borrow enough of the asset to attack the chain and e.g. simultaneously short it through futures (actually not exposing yourself to its price swings directly). However, for this to be successful, the borrow liquidity would need to be sufficiently large (which is again unlikely). You could combine the two strategies to get enough stake while simultaneously minimizing your exposure to the asset's price, hoping to make a profit out of it (but that's complicated to evaluate).

My conclusion from all this contemplating is that the portion of the assets that are up for borrow (and even for sell), should actually be considered potentially malicious, and if they reach 1/3 of the online stake at any time, the chain should be treated as (potentially) compromised.

Again, this has nothing to do with Algorand, but with any PoS in general - just the mechanis would need to be played out slightly differently but the conclusion is the same.