You seem to be interested in 51% attack... yes?
Then download Satoshi's whitepaper: https://bitcoin.org/en/bitcoin-paper, go to article 11 (Calculations).
And you'll see the chance of doing that "heist", as well as the theoretical budget that you need to execute such an attempt based from needed hash power.

You can also learn what are the possible options (not just re-connecting orphaned blocks) for the attacker;
and lastly, why merchants/services are waiting for more confirmations