I am not 100% sure, to be honest. I think there is a difference between getting to know the intent ("a payment has been triggered") and the actual confirmation (kind of like showing a printout of the money wire). The intent can spread arbitrarily fast through the network ("A has triggered a payment to B"), but only the miners can compute the actual confirmation, which takes longer. As long as the miners haven't confirmed it (by computing a block), there is the risk of double spending. I suppose those merchants simply accept that risk. They don't have to actually ship before they get the real confirmation anyway.
Comments
I am not 100% sure, to be honest. I think there is a difference between getting to know the intent ("a payment has been triggered") and the actual confirmation (kind of like showing a printout of the money wire). The intent can spread arbitrarily fast through the network ("A has triggered a payment to B"), but only the miners can compute the actual confirmation, which takes longer. As long as the miners haven't confirmed it (by computing a block), there is the risk of double spending. I suppose those merchants simply accept that risk. They don't have to actually ship before they get the real confirmation anyway.