replace by fee – Could you use RBF to take back stolen funds?

Yes. All bitcoin transactions that signal RBF (Tx1) can be cancelled (replace output with yours) using some wallets with Tx2.

Wallets that support cancellation by RBF:

• Bluewallet
• Electrum
• Sparrow

Tx2 could be then replaced with Tx3 by the attacker using RBF as Michael mentioned about the race in his answer.

Attacker could also use CPFP for Tx1 in combination with or without access to whole wallet. You can do CPFP if there was change in the transaction that belongs to your wallet.

Cancellation of unconfirmed RBF transactions would also be possible in Bitcoin Core if PR #25344 is merged.