I read in many places that mining involves finding nonce
such that SHA256(SHA256 (blockheader_including_nonce))
meets a specific criteria (0 bits...).
Why is this hashing done only on the < 100 bytes of the block header? If it's only done on header, doesn't this mean we could modify a transaction in the block and keep the same block header and hash?
How is this not a weakness?