transactions and 51% attack?
I just watched a video which stated 51% attacks can't steal bitcoins from people's wallets. Is this true?


Yes, 51% attack cannot steal coins controlled by other people's keys. When you sign a transaction with your private key, you include the entire transaction data as a message in the signature hashing algorithm. Thus changing any data within the transaction (output value, address of the receiver etc.) will render the signature invalid and hence the transaction as invalid. An attacker can only make cosmetic changes like signature malleability (S component of signature can be replaced with -S) which can also be done by any other miner or an intermediate node in between that is relaying your transaction.


  My understanding is if someone successfully implemented a 51% attack then they would most likely have manipulated one or more of the transactions which had been confirmed in the original true bitcoin chain.


An attacker cannot manipulate transactions as I have stated above. What the attacker can definitely do is exclude the transaction from their version of the chain thus bringing in a censorship attack.

When you read news articles like "attackers stole coins from 51% attack" it does not mean they changed the transaction data. This is how the attack happens: An attacker sends some coins to an exchange. This gets recognized on the Bitcoin blockchain and after that gets reflected in your exchange account. Now on the exchange portal the attacker exchanges BTC for any other coin like say ETH and withdraw the ETH coins from the exchange account to their personal wallet. Now, they launch a 51% attack and create a different version of the Bitcoin blockchain that has excluded that transaction in which they sent the coins to the exchange. After your chain becomes the longest it will be accepted as the main chain. Thus you end up in BTC and the ETH that you got from the exchange. Although I have given the example of Bitcoin, do note that BTC has never experienced a 51% attack.


  This would then mean Sarah no longer has the 1 bitcoin in her wallet effectively stealing that 1 bitcoin from her.


Yes, this is the same example I have mentioned above. However, as confirmations on the transactions increases, the more difficult it is for an attacker to exclude transactions.  If there are tens of confirmations on the transaction, then reorging with just over 50% hash rate will take days if not weeks. Thus most recent transactions are more vulnerable to the attack than previous ones.

I think rest of your questions follow the similar tone. It is a best practice to wait for 6 confirmations, but if the amount sent is really large enough, it will be prudent to wait for tens if not hundreds of confirmations.