As the two coins operate on a common history and effectively use the same technology... including the same private keys and hash algorithms... the signatures on transactions are effectively valid on BOTH networks.
A replay attack is where someone takes a transaction from BTC network, and broadcasts it on BCC network to execute the same transaction. This is usually where you send someone coins on BTC, they can then effectively execute that exact same transaction on BCC network, and get BCC from you.
To prevent this, you would normally need to execute some carefully crafted transactions in a specific sequence/timeframe... the idea being that it "splits" the coins... so they are in different "outputs" on each chain... so a transaction from BTC can no longer be sent on BCC network (and vice versa) because there is no longer that common history, so the signatures will be different.
I believe that the BCC devs have attempted to address this issue... and transactions use a different sighash algorithm which prevents transactions from one network being replayed on the other... refer: https://bitcoin.stackexchange.com/questions/56867/bitcoin-cash-replay-protection/56874#56874
THanks for the clarification