Are there still possible scenarios for transaction replays from Bitcoin Cash or vice versa?

I have three questions with regard to replay protection.

Q1 => Some non-standard scripts (like x + 2 = 5) do not require signatures (so naturally no SIGHASH_FORKID) to spend the UTXOs. Are these UTXOs and transactions still prone to replays?

Q2 => I have read the documents from the inception of Bitcoin Cash and realized that the legacy transaction digest algorithm is not being used anymore. From my understanding, the 4-byte sighash type is appened at the rear of the digested transaction input (Both for SigVersion::BASE and SigVersion::WITNESS_V0) and if a unique sighash flag is used, the uint256 SignatureHash result would be completely different. The SignatureHash function in the src/script/interpreter.cpp file of Bitcoin Cash only allows BIP-143 digest algorithm when SIGHASH_FORKID is in use. What if Bitcoin Cash developers only enforced the use of SIGHASH_FORKID and embraced Segwit? Is a unique sighash flag not enough to prevent replays?

Q3 => If a unique sighash flag (SIGHASH_FORKID) is not enough to prevent replays, then is it because of the malleability issue on legacy transactions?