How to secure session cookies
The value of the cookie needs to be kept a secret, otherwise as you point out, someone can 'hijack' the session and perform actions as the original user.

Under normal circumstances an attacker wouldn't be able to get the value of this cookie from your browser, if they can, then they're into your machine, and can probably do what they like. Game over.

That leaves man-in-the-middle attacks as a way to get the value of this cookie, and you avoid those by running the site over HTTPS, so that the value of the cookies is encrypted in transit, and only readable by the client and the server.