Security isn't a binary yes/no thing and double-spending-for-a-fee does not require unconfirmed transactions. Confirmed txns can be replaced too, it just costs more.