Slight correction.
51% attack requires 51% of combined hashrate.
So attacker needs 51% of the combined hashrate including existing BCash/BCH hashrate + the attacker's hashrate.
Using your #s, if 4.99% is mining BCash, attacker needs at least 5.00%, leaving 90.01% mining Bitcoin.