Can a transaction that has been signed and broadcast to the mempool be intercepted if it uses the sighash NONE|ANYONECANPAY?

Question

Example:

Alice creates a PSBT and signs her input using the SIGHASH_NONE | SIGHASH_ANYONECANPAY flag. She then passes this transaction to Bob. Bob adds his own input and output and signs them with the SIGHASH_ALL flag.

Question:

Is it correct to say that John or any other participant in the network could intercept this transaction in the mempool and use Alice’s input for their own purposes?

Answer 1

Yes, with SIGHASH_NONE | SIGHASH_ANYONECANPAY (0x82) Alice is basically giving away access to her input. Anyone could use it to build any transaction.