It is a type of exploit.   The person sends funds without a transaction fee, then sends again with a fee.   The transaction with the fee will get confirmed and the other will eventually get rejected by the network.   It can also happen if a mining pook has then 51% of the global hashrate.   They would technically be able to chose which transaction were confirmed and which weren't.