P2SH secure spending. How? Maybe my question is stupid, but

imagine that I'm trying to spend inputs from p2sh. 

For example, p2sh scriptPubKey looks like:

OP_SHA256 4bf5122f344554c53bde2ebb8cd2b7e3d1600ad631c385a5d7cce23c7785459a OP_EQUAL


I know, that the SHA256(0x01) = 4bf5122f...85459a (hacker do not know that, until I broadcast tx)

So I broadcast transaction with the folowing scriptsig:

OP_1 (0x51)


Why hacker can't take this unconfirmed transaction, extract scriptsig, and replace outputs to his own outputs ? 

Also, what to do, if RBF (replace-by-fee) flag is set?

Of course, I'm not talking about transactions with OP_CHECKSIG
You're correct that anybody could just replace the outputs and take the funds for themselves.  This script has no authorization needed on the spender's part, so once the redeemscript is known, it's practically become an anyone-can-spend script.

Assigning an RBF enabled sequence (or not) on the transaction makes no difference (perhaps only for relay policy), since any sequence set can also be replaced by anybody.