Is it true that any UTXO's that are unspent prefork of BCH AUG 2017, has a risk of a replay attack? Say I have 1 BTC in my wallet which has never moved since 2016. Now I load that private key into BCH wallet and now I have 1 BCH. I make a transaction on BCH to a vendor, but now he takes that same transaction and broadcasts it on BTC chain. Now I lost my BTC too. Is this correct?
No, BCH and BTC transactions were never replayable to the other network. Starting with the very first BCH block, all BCH transactions were required to use a different
SIGHASH_FORKID than used in BTC. This mandatory replay-protection causes BCH transactions to appear invalid to BTC clients, and vice versa, BTC transactions to appear invalid to BCH clients. However, (pre-segwit) addresses remained compatible between the two network, which caused some user confusion.
I assume that the fact that the replay protection was always mandatory may have been lost on some observers, because BCH's replay protection was only made mandatory a couple days before BCH forked off, so a lot of the prior discussion and worries became obsolete last minute. Alternatively, the source of this worry may have been confused by BSV forking off from BCH without any replay-protection whatsoever.