Stealing a correct hash because of an invalid block
It's not a valid working process: all transactions commit to the block hash.
First of all a miner cannot &quot;find a right hash&quot; then insert a double-spend transaction. This would invalidate the hash (and the block, actually).
For the same reason, a node receiving the block cannot malleate the coinbase transaction. It would not be able to &quot;immediately produce a block&quot; either.
In addition, blocks have consensus rules and a valid block does not only consist of a block header hash inferior to the target but must respect a number of other rules as well (locktimes, existing outpoints, valid scripts, ...).
The cost of producing a valid PoW is so high that you would not expect a miner to commit energy to an invalid block.