bin/lint uses core’s linting config, and therefore does not support themes or plugins. If you use it, you’ll probably get failures in your theme/plugin CI. e.g. even tiny version upgrades to prettier can make subtle changes to whitespace handling.
Yes, that is essentially what the mass-pr scripts do 
update-linting.sh is the one you want. Other scripts are for more specialized rollouts.
You can. Or you can just re-run it every so often, when you want to update the linting config for your theme/plugin. Since the config is fully self-contained, a change in core will never affect the linting in your themes/plugin - they’re completely decoupled.