2. Bitmain flipping the kill switch.
Now the first one is unlikely because such a step will only hurt their investments by denting bitcoin's reputation. Bitmain flipping the kill switch and outright attacking the network as a last resort to prop up BCash is the most likely scenario.
What do you mean by a "kill switch"?
Do you think that Bitmain has some kind of backdoor in their ASICs which would allow them to seriously damage the equipment? Also, Bitmain controls a lot of hashpower, they could slow down the whole network if they turned off their ASICs right after the difficulty adjustment.