Logically, everything is correct. A puzzle solver does not acquire ownership of coins just by finding the key. His responsibility is also to protect his potential property (for example, by sending a transaction through Mara). If he did not do this, then the bot that used RBF and received the coins becomes the owner. Because ownership initially belongs to the creator of the puzzle and is transferred by the creator to anyone who takes the coins as a reward.

However, on the other hand, the condition and basis for acquiring ownership of coins is to find the key. The use of RBF is not a ground for acquiring ownership rights. Because it was not specified by the creator of the puzzle. So it's not all that clear. However, on the other hand, the condition and basis for acquiring ownership of coins is to find the key directly. That is, not from the sent transaction - not from the public key disclosed in the mempool, since in this case the key has already been found earlier. Then the use of RBF is not a basis for acquiring ownership rights. Because it was not specified by the creator of the puzzle. So it's not all that clear.

In other words, is the ownership of the one who finds the key second (from the transaction) legitimate? My subjective opinion is no. Since this does not meet the main purpose of the puzzle (testing the security of keys) and such a condition for acquiring ownership of the reward is not explicitly stipulated by the creator of the puzzle.