If I have a contract deployed to an exchange. From there I (hacker) can download the abi for that contract. So, now I have the abi and let's say I have the address of the owner (victim) as well. So, now if I add the abi in my code (lets say in react code) and then I call the transfer or transferFrom function and say that transfer all the tokens to my account (hacker account) then how come is this secure. Please correct me I am stuck in this situation.
Ethereum transactions are done with public-key cryptography. It does not matter if ABI is known or not. If the hacker does not have a private key of the victim, the hacker cannot pose as a victim or do any harm.