> The thief saw the receiving transaction to the address A and made a transaction to address B while the transaction to address A was still unconfirmed.
The fee paid for these transactions was high enough and a miner include both of them in the same block.

So the Tx from Kraken (in the mempool) is considered unconfirmed, and because it is in the mempool, it's ok to spend the utxo of this tx in another Tx?

This can obviously be only done by some mempool-watching bots.

Is it common to see this pattern in the blockchain?