I am not 100% sure, to be honest. I think there is a difference between getting to know the intent ("a payment has been triggered") and the actual confirmation (kind of like showing a printout of the money wire). The intent can spread arbitrarily fast through the network ("A has triggered a payment to B"), but only the miners can compute the actual confirmation, which takes longer. As long as the miners haven't confirmed it (by computing a block), there is the risk of double spending. I suppose those merchants simply accept that risk. They don't have to actually ship before they get the real confirmation anyway.

The transaction show up immediately as 'pending' and will get 'confirmed' after about 10 minutes. Squareware can choose to conditionally accept the 'pending' transaction on the spot because they can simply wait for the transaction to be confirmed before shipping out your stuff.