Yup that is correct but that window is reduced to a minimum. Your adversary will need to crack your PK in 10 mins and submit a replacement transaction which may or may not be accepted.