So a merchant would generally only wait for confirmations for large transactions. For small transactions it is enough to detect the transaction is in the network, i.e. more or less instant.
I have yet to see or hear of a merchant that doesn't require a minimum of at least 1 confirmation. In theory, it might not be needed, at least if there is a sufficient transaction fee to prioritize it.
However, I believe the merchants/processors are all practicing CYA / "better safe than sorry," and requiring a minimum of 1 confirm, for even the smallest transaction, and larger transactions/operaations generally requiring 4 or more confirms.
Perhaps in the future, buyers will acquire some sort of insurance card or "performance bond" requiring a small deposit with a trusted third party reputation service to demonstrate to the merchant who will publish the buyer's "Wallet Address" in a merchant-accessible database of bonded addresses.
And the merchant will treat payments from listed addresses as immediately confirmed, based on their reputation.
However if the buyer double spends in less than 48 hours, and the merchant can later demonstrate that they were given a signed transaction which not get confirmed, by submitting a copy; the buyer will be alerted and given a short time to settle up.
E.g. 5 days to replace the double spent transaction before their reputation status is suspended, deposit is taken to pay the merchant, and they get a bill in the mail in the amount of an agreed upon "penalty".