have been reading this thread for quite some time but I think I missed the part about BOTs where someone tries to steal the sats after when someone withdraws the BTC.
Search for slipstream.mara.com and you will find answers in this thread or the other one with 1000 BTC in the thread's title.
TL;DR is, you can't safely publish the withdrawal transaction where you expose the public key when you want to claim low-entropy puzzles after you managed to find the private key.
Bots will recognize your transaction, take the public key and find within seconds the private key with Kangaroo or whatever is really fast for this. They will then simply replace your withdrawal transaction with their own to their own address. Bots will compete against each other until some substantial amount of the puzzle's price will become transaction fee. Mining pools might participate in this race because they may benefit from the rising transaction fee that every Full-RBF replacement will cause.
Simple answer: you can't publish the withdrawal transaction publicly, you risk loosing the replacement race and thus the puzzle's prize.