But it would take resources to intentionally orphan the last block in order to double spend a transaction with 1 confirmation. It takes no resources to double spend a transaction with zero confirmations. So, there is some security improvement when you compare 0 confirmations and a longer block time, to 1 confirmation with a short block time.
I understand what you are saying.
But help me understand the Bitcoin protocol here. Let me know if I have some of this wrong:
The Bitcoin network is interconnected nodes that share unconfirmed transactions by broadcasting them among the nodes. A wallet application joins the network by connecting to one or more of these nodes. When BTC is sent from one wallet to another, it is sent through the network and the receiving wallet sees the transaction. A transaction must be verified by a node before it is sent to the next node. Part of this verification is a check to see if it duplicates an input from another transaction, either one in the blockchain
or one in the unconfirmed pool.
Thus, it is difficult to double-spend because the transaction with a duplicate input would have to be introduced into the network before the 1st has propagated. Not only that, but the double-spend would only work if the recipient of the 2nd transaction was connected to a part of the network to which the 1st transaction hadn't been propagated.
Thus, to protect against a double-spend, the recipient only has to wait long enough for the transaction to propagate through most of the network. This is less time than the wait for the transaction to be confirmed in a block.