Re: Look at the last merges, devs are already fixing the malleability problem
Up to now, people (including the reference software) have relied on the transaction id being meaningful.
There is a difference between a txid of a x-times verified transaction (in blockchain already, x>=y where y>0 (usually 6) is the security block count of the receiver) and a txid in an unverified transaction. 
100% correct. Until there are sufficient confirmations, you cannot depend on it. Even a transaction can be replaced prior to confirmation which is why confirmations matter. The reference client displays unconfirmed transactions as a user convenience since they can be altered but does not rely on transaction IDs for refunding money.