Hopefully brick-and-mortar stores that accept zero-conf (probably very few) understand it's no better than a personal check** and that they should take ID to reduce risk of fraud. Websites that do this should think twice about how well they think they understand the protocol.
** Actually it is slightly better, because as notme pointed out, you can't reverse a bitcoin transaction once it's been properly confirmed. So the risk of fraud is smaller with a zero-conf and perhaps some folks think it's fine to accept zero-conf from an untrusted party for this reason. I don't agree (that the risk level becomes manageable for that reason), but we'll see who gets burned.
Zero-conf has got to be better than a check if no double-spend is detected within 5 or 10 seconds. By that time every Bitcoin node should have seen the first transaction. If a 2nd one appears then its time-stamp will be seen to be later by all nodes. So the later one is unanimously rejected.
Yes. You could pay at a restaurant, walk out clicking a buy button on a website for some shoes and have your ASIC farm churn away to produce a block with your shoe transaction invalidating the restaurant payment. But what an effort! Surely restaurants have walk-aways and shoe-shops have shoplifters far more frequently than such a double-spend scenario could happen.