Zero-confirmation transactions can easily be double-spent by another signed transaction spending the same UTXO, but with an arbitrarily higher fee, thereby achieving a higher likelihood of being mined first, rendering the original transaction invalid.

A merchant still needs a full-node to accept new transactions to the memo-pool, because it needs to validate each new transaction it sees.

A lightweight wallet does not have the same security as a full-node, because it relies on verifying the accumulated POW, and not the actual transaction validity. The assumption is that the chain with the most accumulated POW must be valid.