Security implications of removing CHECKSIG in a test
The security implication of removing a checksig operation from the encumbrance script is that the coins can be stolen while in flight by anybody, and especially by miners.  Obviously, on testnet, only someone who's bored or interested enough to grab the coins will take the time to "attack" your transactions.

There's not much sense in listing and analyzing the vulnerabilities in your method.  Testnet coins are worthless and certainly nobody will take the time to brute-force sha256, or grind through a hash table to get them.

As for checksig-less scripts in general, there are indeed bots on mainnet that listen for such transactions being relayed and try to grab any coins.  It's probably easy enough to run the same bot on testnet.

In any case, if you want to avoid this scenario altogether, you can migrate your setup to regtest.