The risk of a transaction never getting picked up is essentially zero. Currently blocks are on average only 5% "full" so miners and mining pools tend to include all transactions. For a transaction to never be included it would require that no miner on the planet ever include this transaction.
If it did become a risk you could always require a fee is user wants to download at 0-confirms. You can enforce this by checking the transaction. The fee amount if the difference between inputs and outputs. If they are the same then there is no fee. For users which ignore your instructions and submit a no-fee transaction you could then just wait for 1 confirmation.
The greater risk comes from a "double spend" or "51% attack" however these risks are often overestimated. Allowing digital downloads paid by credit card has risk too so achieving 0% risk isn't a viable business strategy. Even if your software never has credit card fraud is likely has losses due to piracy so the best solution is one that maximizes net revenue not one that attempts to eliminate all fraud.
Each business needs to look at the risk of their specific product. The higher the value the more likely you should consider using confirmaiton. There is little value in executing a double spend attack to get a 1 BTC ($3 USD as of writing) copy of say "Super Angry Birds". Allowing instant downloads likely improves sales enought offset any neglible increase in fraud. On the other hand if you are allowing downloads & license keys for SQL Server Enterprise at 2500 BTC a copy you probably should require confirmations.
Confirmation can only reduce not eliminate risk. The less risk you have at 0 conifrms the less benefit there is in delaying your customers. The real question then becomes does the delay end up costing you more revenue than it saves you in near non-existant fraud.