Are unspent UTXO's on Bitcoin from before the AUG 2017 BCH fork at risk to a replay attack?
No, BCH and BTC transactions were never replayable to the other network.  Starting with the very first BCH block, all BCH transactions were required to use a different SIGHASH_FORKID than used in BTC. This mandatory replay-protection causes BCH transactions to appear invalid to BTC clients, and vice versa, BTC transactions to appear invalid to BCH clients. However, (pre-segwit) addresses remained compatible between the two network, which caused some user confusion.
I assume that the fact that the replay protection was always mandatory may have been lost on some observers, because BCH's replay protection was only made mandatory a couple days before BCH forked off, so a lot of the prior discussion and worries became obsolete last minute. Alternatively, the source of this worry may have been confused by BSV forking off from BCH without any replay-protection whatsoever.