What would stop this kind of attack?
They don't wait for confirmations, but they check if a transaction has appeared in mempools of some miners. They could also just check if the preceeding transaction (the source of 10 BTC) exists on the blockchain.