If CAS does need firmware as long as you connect a good battery support there really is no need to remove CAS, having done countless downgrades over the years there really is minimal risk. Worst case you would remove and repair on bench but very unlikely to have an issue here anyway.
Time wise there won't be much in it bench or OBD method about 15 mins again depends on a circumstances here.
Firmware and encryption are not the same thing, Hence after downgrading software version you will still require ISN/SK ect. to decrypt the CAS, this is what is found from CAS3 +
All CAS and all modules for that matter are ISTA/P of some level, many people will say if the CAS is ISTA/P and this makes little sense, when CAS integration level reaches 45+ then this is when firmware downgrade will be required to access Eeprom over OBD.
Tip. if you get to AKL situation pick lock and hold in open position if windows don't open then firmware will be required, as this was one of the security features added in ISTA/p45+. I say this as 2007 model is hit and miss. Ive even asked customers looking for a spare to do this so I can give fixed price as if its just CAS3 entire job will only take 1-2 mins.