It is true that one advantage FRA has against MUC or ZRH (or for that matter CDG T2E) is that it technically doesn't need an unclean non-Schengen car, given that arrivals would be able to walk to landside easily from any point, something not possible with satellite configuration... that would mean that within T1/T2 the train could be made wholly secure with S and NS part.

I was wondering how the train to T3 would impact that, but on reflection, that train is a separate system that could remain unclean. That would necessitate one-way filter from old to new, and transfer security from new to old (for NS pax), but I guess that could be made to join in the existing transfer security? Schengen pax would just enter via departure checks.