How could a lightweight wallet determine the validity of 0-conf transaction? I found that a lot of people are interested about security of 0-confirmation payments. But, it seems that most discussions focused on double-spending (like broadcasting two or more conflicting-but-valid transactions, or Finney attack), instead of the validity of the transaction. Does a merchant accepting 0-conf have to run his own full node, or trust someone else (like a public block explorer service), to validate the transaction? Does a lightweight wallet have the same security as a full node under this 0-conf scenario?
Zero-confirmation transactions can easily be double-spent by another signed transaction spending the same UTXO, but with an arbitrarily higher fee, thereby achieving a higher likelihood of being mined first, rendering the original transaction invalid.

A merchant still needs a full-node to accept new transactions to the mem-pool, because it needs to validate each new transaction it sees.

A lightweight wallet does not have the same security as a full-node, because it relies on verifying the accumulated POW, and not the actual transaction validity. The assumption is that the chain with the most accumulated POW must be valid.