Replace by fee (RBF) just means that the sender can resend the transaction with a higher fee, if they accidentally set a low fee and dont want to wait hours for confirmations. It is possible to double spend an unconfirmed transaction without RBF flag.
When the transaction has 1 confirmation it is safe from double spend attacks. Thats why it is important to wait ca 10 minutes for 1 confirmation before sending the product. For high amounts some people prefer to wait for 3+ confirmations.