up until now, there's reasonable security in accepting unconfirmed as long as you've got a full blockchain by which to compare the transaction's inputs and outputs.
Except that there really hasn't been any security in that, just hope. People have been living on the hope that those transactions would be confirmed some block in the future. Most of them got away with it. But they never had any security, not really.