The attack model changes based on transaction size. For sub 10,000$ transactions the threat model is not someone with more hashing power than the network. It's someone with 1/k th the networks processing power getting lucky. Which is bound by both total network hashing power and the number of blocks you wait giving a significant usability advantage to faster blocks.