How does BitPay manage to confirm transactions so fast (less than a minute)? I believe it takes about an hour for 6 confirmations. (Edited from David Schwartz's comment)

However, when I purchased some stuff from merchants who used BitPay, the payment/orders were confirmed in like 20 seconds or so?
Since BitPay is confirming the order before 6 confirmations, how does it protect itself from double spending attacks?
BitPay takes all the risks of a double-spend and they don't wait for any confirmation to make the user feel good with the purchase. The merchant doesn't care because they'll receive fiat and most of them are not direct access purchases.