Do I understand it correctly that if those Dice services waited for even 1 confirmation, this attack wouldn't happen?
No, with 29% hashpower a double spending attack would have a
60% success rate on confirmed transactions. The fact that the success rate isn't 100% would just mean that they'd need their profits when successful to be at least 17 BTC in order to make up for the cost of a lost block (less if they don't have to pay their miners for orphans).