Yes and no. DDR2, 3, and 4 do training, but not for as many signaling parameters and with wider margins due to the lower clocks. So it wasn’t until DDR5 that it took long enough become a well known thing.
Training occurs in all DIMM installations. Just gets notably more involved and takes longer in DDR5 2DPC configs compared to everything else.
No. Training is required at JEDEC speeds and timings and JESD79-5 standardizes speeds from 3200 to 8800 MT/s in increments of 400 MT/s. I’ve seen also mentions of also standardizing DDR5 at 9200+ but, so far as I know, JEDEC hasn’t done that yet.
No. XMP specifies a clock, voltages, and a few primary timings. It’s not involved in training. Same for EXPO.
No. Succinctly, the main training operations relate to CA, CS, write leveling, ZQ, VrefCA, VrefCS, VrefDQ, and ODT rather than what you’ve described. Refer to the relevant 12 subsections or so of JESD79-5 for the details.
I lock them. It’s really no a big deal.
I don’t know of any BIOS flash which doesn’t do that. Which is stupid since many of us then reenter the same parameters after every update. Yeah, if a load line moves or Vsoc gets a lower cap or something then there’s some constraints and maybe some thinking and retesting needed. But for the most part it’s invariant stuff like reentering all the control points on the fan curves, DIMM clocks + voltages + timings, or disabling wifi so your wired box doesn’t have that pwnage route.
That’d be a spectacularly weird way of deserializing a data file instead of just pulling it into memory and invoking the usual code to serialize to flash if the user chooses to save the BIOS settings and restart. Since anybody with physical access to the machine can do whatever they want in the BIOS menus without needing to load a saved profile from USB it’s not like it’s worth worrying about a security model.
But, eh, don’t my decades of experience writing similar code and maintaining its tests stop you from being convinced this is much harder than it actually is.