As today, you need the full game engine to show a replay, because of the way, a replay is saved. So, this makes it a little hard for an external replay viewer.
But if you set up the project clever enough to reference to the same source files for the same code needed as in the game, the additional effort shouldn't be neckbreaking. Of course, the player needs to be tested at least once a new patch comes out.
Other solution would be to move the security checks from loading the s2 content to e.g. starting a race and steering controls (as backup). But this leads to the security discussion already mentioned by keiran.
The holy grail to almost all replay issues is again to change the replay recording format to something, that does not depend on the game engines physics. This would result in an independent replay engine, that can be allowed ro read S2 content, since you cannot use it for driving races.
But this is definitely a lot of work and I guess, the replay files also would get much bigger.