Ah yes, I remember now. You caught me at a bit of an unfavorable time: I was in a hotel on Gran Canaria, and my wife had just broken here lower leg in two places during a mountain hike there. That kept me heavily occupied. I am just starting to recover a bit from that. (For my wife it will unfortunately still take a lot longer...)
As to your question: WinBoard does have its own move generator, on which it can base legality checking. This is a later addition, however; originally it was just the graphical front end of GNU Chess, and the latter was responsible for the legality checking of input moves. So any move would be accepted by WinBoard (except with empty squares or opponent pieces, or moves ending off board and such obviously illegal things), and then sent to the engine, and the engine could then reject it with an error message, which would then make WinBoard undo the move and notify the user. It still works that way when legality testing is switched off. But with legality testing on WinBoard would not even relay illegal moves to the engine, and make the piece jump back to its starting square as soon as you release it.
It would indeed be necessary to store a flag with each move to indicate the legality. We cannot trust on running WinBoard's own legality test acting on the move, for that purpose, as the main reason that people swicth legality testing off is to play variants that have rules different from what WinBoard would think. WinBoard and the engine then do not agree on legality, but WinBoard is silenced by suppressing its testing. If we have that, I guess indicating illegal moves with a red arrow becomes easy. The flag would only be set if the engine rejected the move.
Engines essentially also start a new game after setboard. Meaning they lose memory of everything that happened before it. So sending them a setboard on every position would make it impossible for them to recognize 3-fold repetitions.