But my first transaction was mutated, and the mutated version was accepted into the blockchain. This means that the transaction I used to pay for my donut is now invalid, and Waves/BitPay won't get the money (and I've already left the store).
Yes, that is possible, but that's nothing new. Accepting with zero-confirm transactions is risky.