Now I'm confused.
You are confused because you are talking about two completely different things as if they are both the same thing.
Thing number 1: Accepting an unconfirmed transaction that is funded by confirmed outputs.
If someone sends you a transaction,
and the transactions that the inputs come from are confirmed, then malleability doesn't affect you. As long as the transaction is well propagated and includes an appropriate fee, it's a pretty small risk to accept it. For small value payments, most merchants would consider this an acceptable risk (probably a lower merchant risk than shoplifting, chargebacks, and counterfeit bills).
Thing number 2: Spending the output from an unconfirmed transaction.
If you receive an unconfirmed transaction,
and then try to spend those bitcoins that you just received before they have confirmed, you then have a problem with malleability. The transaction ID of the unconfirmed transaction could change before it confirms, which would then make your transaction invalid. While it is often reasonably safe to accept unconfirmed transactions, it is never very safe to spend those bitcoins until the transaction has confirmed.
