[gojomo]

This theoretical problem isn't that big in practice. Ensuring your malicious second-spend 'wins' the confirmation race requires a lot more effort than an ill-gotten morning cup of coffee is worth.

If it actually started happening -- burning merchants who accept 0-confirmation transactions -- a bunch of cheap countermeasures could be adopted. For example, only accepting 0-confirmation transactions from certain origins with a traceable reputation, performance bond at trusted third party, or subject to other recourse/debt-collection. Or, having a consortium of major pools commit (for a tiny fee) that they haven't seen a competing transaction and will prefer the one presented first, by the merchant.