Or in 40 to 70 minutes the merchant finds out you sent the same outputs to 4 other addresses... and the transaction you sent to him was not confirmed.
Equivalent of writing a bad check but he has nothing to go on to recover his losses.
True. it's a legit risk. I like using the number of confirmations relative to the amount as a way to mitigate the risk. So if I were selling a car I would want 6 confirmations. If selling a bag of popcorn, I might not even wait for one.
There is no single instance in the entire history of Bitcoin of this ever occurring.
The same output has to occur in the same moment of the initial transaction and has to be propagated on the network in such a way that is is impossible to detect before the thief runs away with the swag (his coffee).
Any merchant who is worrying about this should not be running a business - there is more chance that the cash they are accepting is a forgery, or that the customer is a suicide bomber about to kill everyone in the shop.