The transactions still have to be valid (accepted by majority) to get consensus.

It's just that some subset of valid transactions are exploiting vulnerabilities in poorly written contracts. In this case, you want to make dead sure that your "good" exploit runs first.

This is not usual.