What would stop this kind of attack? Many gambling services (and p2p exchanges) do not wait for confirmations before exchanging value (many realize their customers will not wait 6+ hours for a confirmation).

What's to stop someone from sending 10 BTC they don't have, assuming that the party they're sending it to will not wait for confirmations?
They don't wait for confirmations, but they check if a transaction has appeared in mempools of some miners. They could also just check if the preceeding transaction (the source of 10 BTC) exists on the blockchain.