If a transaction takes anywhere from around 10 minutes to hours to get written to a block and put on the chain, how is it possible to have things like bitcoin vending machines? In those cases, the transaction would have to be near instantaneous to make it practical.
Payment channels are a way to prevent double spending in such cases. As per the Wiki
A Micropayment Channel or Payment Channel is class of techniques designed to allow users to make multiple Bitcoin transactions without commiting all of the transactions to the Bitcoin block chain. In a typical payment channel, only two transactions are added to the block chain but an unlimited or nearly unlimted number of payments can be made between the participants.
A possible way for implementing vending machines would involve creating payment channels beforehand with the vending machine company.
Infact, for the vending machine case, an unidirectional channel would suffice. Refer to Wiki for details. Bi-directional payment channels using hashlocks are the key to Lightning network which is used to facilitate off-chain transactions at real-time.
If a transaction takes anywhere from around 10 minutes to hours to get written to a block and put on the chain
Just to have that said: if a proper fee is set, it can be ensured that the transaction will get confirmed within the next block.
Back to the question merit: Performing a double-spending attack is very costly after the transaction has been propagated through the network. There is some risk, but there is some also when accepting cash or credit cards and the vending machines can be often enough fooled with tokens resembling the weight and size of a real coin. There are places, both online and physical that accept small unconfirmed transaction if they are valid, have a proper fee and are already propagated.
Additionaly, there are services such as Coinbase, that additionaly verify transactions between their users. If the transaction occurs between Coinbase accounts, it can be even more sure to appear in the blockchain, even if it isn't yet confirmed.