Correct - there are various attack vectors besides the 51% attack. Ideally, a transaction shouldn't be closed until there have been 2 confirmations.