double spend the mempool to outbid an attacker

Question

if I spend some input in a tx and a few seconds later spends the same input with other inputs in another tx with higher fees. If the first tx is still in the mempool would the 2nd tx replace the first one?

With a hot wallet I can receive a notification on my phone every time an input is spent and if I reply to the notification (somehow wallet has been compromised) then I could broadcast a signed tx with all my inputs to another address I control with higher fees. I could potentially outbid the hacker and save the wallet?

Answer 1

Many nodes today will not replace any transaction in their mempool with another transaction that spends the same inputs, making it difficult for spenders to adjust their previously-sent transactions to deal with unexpected confirmation delays or to perform other useful replacements.

First paragraph of 'Abstract' section in BIP 125

Maybe if the transaction had RBF enabled it would be helpful or if the transaction had a change address in outputs to try CPFP

Hackers are expected to use high fee rate, no RBF, no change address etc. although it's not the case in lot of incidents that I have observed.