The only relevant part is that the TX exposes the public key of a low-range address. The other addresses and the rest of the TX is totally irrelevant.

Once that happens and the private key is found (a matter of seconds, if not less), than the finder owns the private key and legitimately owns the address, no matter what some moralists think.

Since the private key is owned, then a new TX can be created, signed, and broadcasted, which can replace the original TX in all the nodes of the network, as long as the miners will prefer it over the old one (higher fee).