Or in 40 to 70 minutes the merchant finds out you sent the same outputs to 4 other addresses... and the transaction you sent to him was not confirmed.
Equivalent of writing a bad check but he has nothing to go on to recover his losses.
True. it's a legit risk. I like using the number of confirmations relative to the amount as a way to mitigate the risk. So if I were selling a car I would want 6 confirmations. If selling a bag of popcorn, I might not even wait for one.