According to OP question, the attacker likely double spent the coin using RBF is what that likely happened.
If the transaction was visible for a full day and then it disappeared, that means the other party used a very low fee, because most normal fees would make the transaction confirmed within a few hours max.
You are correct, but I just want to point out that it does not mean that the transaction can be seen by the victim the whole day, the bad actor can immediately use RBF to cancel or invalidate the transaction anytime that he knows the victim has paid already.
Seems like that scenario.
Maybe, since the mempool is super low and OP looks like he doesn't know anything about bitcoin and so on, the seller chose a super low fee, let it sit for some hours cause he knows it won't confirm anyway, then double spent it and the money was gone.
As a newbie it is really important to educate yourself better how bitcoin and crypto currency works. If you don't then you open yourself up to the possibility of getting scammer. There are a lot of black sheep out there.
Where ever you found the scammer, try to get him to sell you something again, make a trap with a new account or something like that. If he bites you can get him and possibly get your money back. And don't go alone, bring some backup with you.