The only thing that does not add up is, as I said in my comment above the LOWER FEES transaction was confirmed, AND this transaction appeared AFTER the one with higher fees.
So definitely not a standard RBF transaction. Like the sender “colluded” with the miner to have this second lower transaction in the block.
This is the bit that seems so suspect to me...
But I'm thankful that it's not a blatant double spend at least.