Looking at bitpay's docs (this is a pretty typical setup), merchant is getting IPNs (aka Webhooks) with invoice statuses based on what is happening with that payment on the Bitcoin network - https://bitpay.com/docs/invoice-states.
So yes, as a merchant it's up to you if you want to wait until the funds are there (invoice status == 'Complete') or ship as soon as the payment is detected ('Paid' status).
Bitpay will obv guarantee for the funds to be there when status moves to 'Complete' otherwise they are risking to get hit with a double spend.
A transaction would have to be worth thousands of dollars to be worth the effort of setting up a successful double spend attack. For the vast majority of use cases this concern doesn't enter into the picture at all, and an immediate 0-conf transaction is fine.
So yes, as a merchant it's up to you if you want to wait until the funds are there (invoice status == 'Complete') or ship as soon as the payment is detected ('Paid' status).
Bitpay will obv guarantee for the funds to be there when status moves to 'Complete' otherwise they are risking to get hit with a double spend.