Let me sum things up.

We have transaction_1. It is non-RBF, it uses UTXO A as an input (along with others) and it's a CoinJoin transaction.
We have transaction_2. It is non-RBF, it has two inputs; UTXO A and UTXO B.
We have transaction_0. It has RBF enabled, it creates UTXO B, it's currently unconfirmed. We call this the parent of transaction_2.

We send transaction_1 in node_1 and transaction_2 in node_2 at the same time.
The network is split to those who have transaction_1 and to those who have transaction_2 in their mempools.

One of the CoinJoin makers wants to speed up the confirmation (of transaction_1) and does CPFP.
The attacker sees that CoinJoin is overspent in fees and reverses transaction_0.
Now that transaction_0 is invalidated (because it's opted-in to RBF), transaction_2 is also invalidated, because it's its child.

Now (all) nodes have transaction_1 in their mempool, but it's overspent in fees.

---

Is that correct?