P2SH secure spending. How?
You're correct that anybody could just replace the outputs and take the funds for themselves.  This script has no authorization needed on the spender's part, so once the redeemscript is known, it's practically become an anyone-can-spend script.

Assigning an RBF enabled sequence (or not) on the transaction makes no difference (perhaps only for relay policy), since any sequence set can also be replaced by anybody.