Perhaps to try to exploit some refund mechanism or some drain bramaged assets protocol.

FWIW, within a block as people have noted there is no mandatory order beyond topological consistency (parents come before children), which is why it's best to treat all txn in the block as happening at the same time.  So there is no "first" that matters other than whatever scheme you're trying to hack considers first... which might mean placed earlier in the block.

In practice, miners mostly sort transaction by ancestor feerate, and then if that's the same I think wtxid tiebreaks. So, assuming that the target considers earlier in the block to be first, to be 'first' given common network behavior you'd set your feerate to just slightly higher than the other txn.  It may also be helpful to be *smaller* in terms of weight than the other transaction to make sure that transaction selection doesn't skip over you as the block becomes full because you don't quite fit but include the other txn instead.

There is no particular difficulty in detecting unconfirmed transactions-- many thieves already do this:  The often refrain from stealing from addresses where they have the key in the hopes that the user will reuse the address and send more funds.  But if they see a transaction they try to take the funds as fast as they can and bet that they have faster txn relaying than the real owner along with a higher fee to make their txn more preferable to miners.