This is a nice catch. It’s a good demonstration of people not understanding the terminology of security. When I read:

“do you think the risk is likely? and also likely to be significant/material?”

I am really seeing:

“Do you think exploitation is likely? And will the impact be significant/material?”

Depending on the answers to those questions, then the risk can be assessed.

I think as you observed, “risk” is never “likely.” Risk incorporates “frequency”, however, and that’s when you can use words such as “likely”.