I assume that referencing a Milestone is not sufficient for a vendor (exchange). That is, they must be making sure that both a Milestone is referenced AND that some time or cumulative weight threshold is acheived.
Given that, what is the absolute minimum cumulative weight that a transaction must have to be considered confirmed by a vendor?
What are the IOTA Foundation's official recommendations?