Re: Look at the last merges, devs are already fixing the malleability problem
Up to now, people (including the reference software) have relied on the transaction id being meaningful.
There is a difference between a txid of a x-times verified transaction (in blockchain already, x>=y where y>0 (usually 6) is the security block count of the receiver) and a txid in an unverified transaction. 
And people and software, including the standard client, have relied on the latter.
[Change from an unconfirmed transaction is available for immediate spend]