Problem
Currently, events are emitted as soon as the first block is confirmed. A better security approach would be to wait for a couple of block confirmations after the event is emitted.
The risk the first block is malicious is low, but still good security practice to implement. Better safe than sorry.
Suggestion
Between 4 - 6.
Considerations
More block confirmation degrades UX and increases the relayer queue for concurrent users.