The best way would be to update the existing plugin and give it a plugin outlet and/or customisation API which the theme component can use.
My comment above was specifically about overriding entire JS files (i.e. es6 modules). That is not possible. The asset pipeline automatically prefixes plugin/theme modules with the plugin/theme name/id, so it’s impossible to create a clash with core.
For templates, we know that people (including us, in some situations) do override them, so we will likely keep that system working. But please remember it is a hack. If the original component/controller changes its behaviour, your overridden template will probably cause the site to break.
In general I think the hierarchy you mentioned (core, plugin, theme) should be true - so if you’re seeing something different please do share the details of the file paths in the plugin and theme.