I've been taking my BFRs in C172/Warriors since I let my medical lapse ~8 years ago.
One of the two is going to have to hold a valid medical and act as the PIC for the flight, i.e., one of them will have to hold both a valid medical and a current flight review. So, if the pilot receiving the review is out of flight review currency, and the CFI giving the review doesn't hold a valid medical, neither can act as PIC so it doesn't work. Further, if the CFI giving the review is the one without a valid medical, there cannot be any simulated instrument flight involved no matter which of the two is acting as PIC since a safety pilot for simulated instrument flight must hold a valid medical.
Then it's completely legal as long as the CFI giving the review is acting as PIC.
Your understanding is incorrect. See 14 CFR 61.51(e)(1)(i). Since by 14 CFR 61.56(c)(1) one must be "rated" in the aircraft to receive a flight review in that aircraft, the no-medical CFI receiving the flight review must be "rated" and therefore can legally log PIC time during the review even though s/he is not legal to act as PIC. This difference in the rules between being the PIC and logging PIC time is somewhat confusing, but is well-established in aviation law.
Yes, it is completely legal for someone rated in an aircraft but not qualified to act as PIC to receive a flight review and log the time as PIC time as long as the instructor giving the flight review is fully PIC-qualified and acting as PIC for the flight.