You're technically correct on that point. But it's only one exchange, mtgox, that allowed this limitation to grow unchecked into a major problem, you agree? The problem is removed if only sufficiently* confirmed transactions are accepted. (* I'll admit I don't know how deep into the chain they need to be before the risk is neutralized)
Your misunderstanding here is how it works
I deposit money into gox and withdraw it
mtgox sends it to my address and it get transaction ID A
I mine a block and include the transaction in my block, but as the miner I can CHANGE THE TRANSACTION ID TO B.
I then tell MtGox staff that transaction A didn't confirm. They check it and they see transaction A was rejected on the blockchain but what they don't realize is it was just changed to transaction B by me, so they resend the transaction.

Profit.
And no one knows how long it took for them to notice that numbers don't quite line up in their balance sheet...