Do no-fee transaction represent a greater risk if the product is delivered instantly? Let's say I want to accept payments instantly on a site for digital downloads.

So I publish an address and wait for the unconfirmed transaction, I see the transaction and release the digital download.

However the user may have sent the transaction with no fee. Therefore the miners may not pick it up or the user could issue a new transaction with a fee that gets processed into the block chain.

Is my thinking correct ? and is there away to stop this king of attack ?
It should get picked up eventually, but yes, the user could double-spend before that.

That is exactly what confirmations are for. But it is probably unlikely that you would see massive amounts of "piracy" due to this. I'd just write that off as a cost of doing business. If it does get out of hand, you can go back to waiting for confirmations or accepting "green addresses". 

Also keep in mind that if the users are not anonymous towards you (i.e. they maintain some kind of relationship with you, even just a user registration), you have recourse (you can refuse to continue offering them access until the scores are settled). 

It is a trade-off between relying on trust (that the user pays) versus waiting for the amount of time it takes for the confirmations.