Possible error in the white paper Calculations section?
One way to interpret this is that there is, indeed, a mistake.

A more charitable interpretation is that there are two unstated assumptions:


The attacker is performing a Finney-like attack - that is, he has already pre-mined a block before even attempting the transaction. So while z=0 means the honest network has 1 block, so does the attacker.
The attacker wins propagation races. So if there is a leaf attacker block with the double-spending transaction, and a same-height leaf honest block with the original transaction, the attacker's transaction will be accepted.


Together, these give a 100% chance of success for the attacker if there is only 1 confirmation.

In my own paper on the subject, I have explicitly stated the assumption that the attacker already has one block (while removing a different simplifying assumption).