What happens if by randomness you deploy a contract to the same address then an existing EOA?
Would the deployment be rejected? Would it only be rejected if the EOA has no transaction history i.e a nonce of 0?
You should check EIP-3607
Ethereum addresses are currently only 160 bits long.
This means it is possible to create a collision between a contract account
and an Externally Owned Account (EOA) using an estimated 2**80 computing operations,
which is feasible now given a large budget (ca. 10 billion USD).
The fix in this EIP prevents the worst possible attack, where a safe looking contract
(e.g. a token wrapper or an AMM-type contract) is deployed to attract user funds,
which can then be spent using the EOA key for the same address.
tldr is that it's possible for an attacker to do, even if it would cost a lot of money, but the EIP-3607 is already implemented and theoretically mitigates that possibility