Bitcoin transactions are instant - the confirmations aren't. It usually takes less than an hour for the first confirmation.
Someone could try a double spend attack and would have a 50% chance that Starbucks gets the money and 50% chance he gets the money back to his other address he used for the double spend.
This said, starbucks should wait for one confirmation before they'd accept the payment.
A few days ago on #bitcoin or #bitcoin-dev on freenode I saw someone explaining this: They could connect to a few big mining pools, then wait about 10 seconds before continuing, then they should be able to detect double spends if there are any. This decreases double spend risk quite a lot.
Charging a transaction fee will increase the chances that a miner will include your transaction in the block he mines.
A few miners don't include transactions without fees, if you want to ensure that your transaction gets included you should set the fee a bit higher than the enforced fee.