What people truly don't understand about confirmations is this:

Double-Spend is hard

It is truly an extremely difficult thing to accomplish – Nobody would ever attempt a double spend on something as inexpensive as a domain name.
Not only that, but Namecheap could easily revoke the domain as a result of an attempted double-spend.