As soon as it's moved to Order status, they can pay for it. However, most of the time you are protected from this kind of issue because once the order is moved to "Verified" status (meaning someone on your team has looked over the order and it's ready to be started), they can no longer make changes to the order.
Also the customer's card is not charged automatically - either the customer or one of your employees has to process the payment. Ideally your customer will be managing their own payments since they can see what they owe you when they log in AND hopefully you have triggers doing your collections for you to keep the slackers on track!
