To avoid theft, it is recommended that Bob wait for Alice-side funding transactions to confirm, especially since reorganizations can be problematic. In Lightning-land, there is a concept called "irrevocably committed" which refers to a state where a newly-created contract cannot be cancelled by publishing an older state. This prevents fraudulent activity and ensures that only the latest state is valid. This concept is similar to the confirmation of the funding transaction in CoinSwap, as until it is confirmed, the UTXOs it spends (i.e. the previous state) can still be validly spent by other alternate transactions. This highlights the need for caution and patience when dealing with cryptocurrency transactions to ensure maximum security.