Let me remind you of a few principles: Bitcoin can only consider a transaction as completed after receiving 6 confirmations in the next blocks in the blockchain network chain, and before 6 confirmations, that asset is not in your possession, and the block containing the transaction confirmed by miners may be completely removed from the blockchain chain before reaching 6 confirmations, which are called orphan blocks.
This is not true. Once you got one confirmation, you can't override the transaction with something else.
Some big services require 6 confirmations to protect from double-spending attack (or 51% attack), but it's not related to the issue how puzzle 69 was stolen.
If you got one confirmation (the tx mined by one block at least), you are good. It would be a way too expensive (read "impossible") to pull 51% attack using Bitcoin network.
Normally, whenever a miner discovers a block, they immediately broadcast it to the network so everyone becomes aware and can start working on the next block. However, in Selfish Mining, the miner (or a large mining pool) hides the discovered blocks and strategically releases them in order to:
Render other miners’ blocks useless (orphaned).
Claim a larger share of the block rewards for themselves.