This problem exists with or without finding an attenuated strain. A better way to think about this is let’s say we had two strains of the virus isolated - one that killed 10% of people infected and the other that killed less than 0.0001%. Which one should we use in a challenge trial?
I’m not sure what your point is. Ultimately you need to demonstrate a vaccine is safe and efficacious for the real disease. An attenuated strain isn’t the real disease.
No you don’t if you choose the right attenuated strain, but even if you decided for some insane reason that you had to test the vaccine with a pathogenic strain you do this after you have shown that the vaccine protected the vaccinated person from the attenuated strain.