In a world of RBF, accepting zero confirmation deposit is the stupidest thing a bitcoin casino may do.
Are you referring to the scam where a user deposits into a zero confirmation casino... immediately gambles on a BIG payout bet... if they win, they just let everything confirm and claim their winnings, but if they lose they immediately execute an RBF transaction to attempt to recover their funds?
I concur... you are just asking for someone to try and game the system and cause all sorts of chaos
this is not possible, the casino has to be really stupid to allow that to happen.
first of all those places that accept 0 confirmation transactions don't allow you to withdraw, so even if you win you have to wait for the first one to confirm and if you lose and double spend you will surely be banned (account and IP). in the end casino doesn't lose anything, you just tried their platform!
also there are some other criterias the tx has to meet. you can easily check to see if it is signalling RBF, if it has any unconfirmed input, or if it has very low fees, etc in other words you do a risk assessment and then let the user play.
and i should also add that RBF is not double spend, you can't change the new output in the tx, you have to have the same output otherwise it is double spend and nodes will reject it.