It’s not this. Steam accepted 0confirmations to ease the payment flow. Before the transaction would be mined into a block, the fraudster would submit a new higher priority transaction sending the payment to themselves.