Whenever a delegator unstakes from a validator there is a 500 epoch (~12-14 days) delay before the staked tokens are available to be used. This delay is designed to allow adequate time for any malicious behaviour by a validator to be detected and punished accordingly.
In future, slashing will be implemented that will penalise validators (and their stakers to some extent) in the event of malicious behaviour (such as a double spend). The details of how slashing will be implemented is not yet known. See also this topic for further details on slashing: