I'm looking to create a web app similar to coffee.foldapp.com where they load up a bitcoin address and once you pay it will automatically show the Digital code product. They seem to be using 0-confirmation. I heard it was risky, but why are they doing it then?

It is risky since you accept the transaction without it being in the blockchain. See the accepted answer to this question for a double spend example: as mentioned in the comments it is still difficult to work. This question is related. Merchants are doing it because they are willing to accept the risk for small value transactions. You will hear several percentages on the risk factor but it is generally low. Some examples here and here.

I'd like to do the same approach since my digital items aren't super expensive and have the option for zero confirmation.

Super expensive is relative.

What are some ways to do this? Does the client browser have to constantly ping the server to get a payment status update? Or does the server push it to the client's browser?

The server pushing to the client is the way to go from an engineering perspective.

I'm planning to do this in PHP if its even possible. Or can I just do it without PHP and just tap into API's of other sites like blockchain.info?

Even if you don't use your own node (or other people nodes) directly and want to use the API of a site you will still need to program it in some language. For example, the blockchain.info site has an API library for PHP.

Zero confirmations is risky and not recommended. Best to wait for one / two confirmation

Client browser doesn't need to constantly ping Server. You can use websocket connection for callback on transaction . For example see https://www.blockonomics.co/views/api.html#txnotify