One thing people fail to realize when saying "0 confirms are risky" is that risk is all relative. A lot depends on how valuable the goods are. While 0 confirmation may have some risk it is very low for low value transactions and likely far less than credit card fraud.
Say you are selling a sandwich for whatever $5 is worth in BTC. When you get a 0 confirm it has indicated that your client sees that address has sufficient value to complete the transaction. The risk is simply that before confirmed someone else could purchase something with the same address, a hypothetical "double spend".
Still remember the window of attack is very small. The AVERAGE block completion time is 10 minutes but ~50% of blocks are completed in less than 6 minutes. That means if two attackers timed it so they started their attack right after a block was discovered they have roughly 50% chance of getting both transactions completed prior to next block verification.
To be defrauded BOTH transactions would have to be fully completed and the attacker gone within that window. For low value transaction especially in the real world that is incredibly unlikely. No attacker is guaranteed any sort of "minimum window" the next block might be verified in 10 minutes or in 9 seconds.
Now if you are selling $100K worth of gold then maybe you should wait for 6 confirmations but a customer moving $100K worth of gold likely would understand the need for security.
Unless your physical world business involves both fast transactions AND high street value I wouldn't worry. A bitcoin ATM however would be a good target for double spending thus some other mechanism would be needed to verify the transfer.