Yes there is, already taken care of, if you are the first one spending from that address, nobody else even you can not double spend it, RBF is turned off for all puzzle keys.
Where you get this info, If attacker send new transaction with 3BTC as fees then all pools will be so happy to replace the founder(who solve the puzzle) transaction that in best case have fraction of 1BTC as fees.
Well, I have no useful info about RBF other than what I said, but you are right we can never stop double spending unless miners respect RBF signals from txs.
But I'd say for puzzle 66 it would take at least 5 mins to find the key, but this should be automated where a script runs kangaroo after seeing the address has broadcasted the public key, and then after finding the key it needs to double spend it, so for our thief it takes around 5 mins.
66 solver is screwed.🤣