You can ask a candidate "have you worked with React before". You can ask a candidate "It's not on your resume, but do you have security certifications". You can ask them "do you have any OSS projects you contribute to or like".
Those are all reasonable questions.
The imagined answer you mention "may" happen for any question. You didn't mess up if you ask "do you know React?" and the candidate answers "my last job used Vue, and I didn't have time to learn it on my own due to having 2 religions, 6 disabilities, and 12 kids, so no".
Asking a candidate for work-related experience is not "extremely inappropriate", and your imagined answer is not realistic.
Essentially, as long as your question has a reasonable answer that doesn't involve bringing up any of the protected attributes, it's fine.