Coinbase can easily take care of this. They can have a small reserve and sell the bitcoin as soon as the transaction is published/sent to the mempool. No need to wait for any confirmations. If the transaction happens to be fraudulent†, they just buy the bitcoin back and realize the earning/loss (in the long run they will tend to even out).

†Not sure what the attack vectors are here.