The timers and sequence numbers are for the reliability that TCP gives, not really anything to do with security. See RFC 793, Transmission Control Protocol:
When the TCP transmits a segment containing data, it puts a copy on a
retransmission queue and starts a timer; when the acknowledgment for
that data is received, the segment is deleted from the queue. If the
acknowledgment is not received before the timer runs out, the segment
TCP can, and often does, receive segments out of order, but, using the sequence numbers, it will reorder the segments before presenting the data to the application. TCP guarantees in-order data delivery. Receiving segments out of order does not detect or prevent MiTM or replay attacks.
The initial sequence number is randomly chosen the help with security, but the reason for sequence numbers is about reliability not security. You use some type of encryption (VPN tunnel, SSH, etc.) to provide security. Unencrypted traffic simply is not safe.
Remember that back when TCP was created, we did not have the public Internet, and things were much more trustworthy. Security was not really anything anyone thought about. IP was a government/academic experiment, and you had to be one of the partners to even participate.