You’re right about the privacy and security tradeoffs given there’s no replay protection.

Bcashjr appears to be so worthless that no exchanges will even list it, so it’s just not worth the potential fallout to dox your utxos or fuck something up by getting replayed.