It means that if someone breaks out of your container, they can only do things that user can do.
Can that user access your private documents (are these documents in a container that also runs under that user)?
Can that user sudo?
Can that user access SSH keys and jump to other computers?
Generally speaking, the answer to all of these should be "no", meaning that each group of containers (or risk levels etc) get their own account.
(If you buy a suitable device) You don't have to use the preloaded OS (see Graphrne, Lineage etc).
I'm pretty certain that the USB IF decided to use the max possible Gbps as the cable rating, rather than the mess that was
USB 3.0 USB 3.1 USB 3.1 (Gen 1) USB 3.1 (Gen 2) ...
So it's more likely apple are just being specific in the type of cable you need.
There is a db migration command that I used to do the same thing, was pretty painless, just needed to run that and then update the config iirc
Where are these OEMs that allow proper bootloader unlocking on most of their range?
Google, Sony ...? Huawei stopped doing it, Oppo & Samsung doesn't last I checked.