Yes to all.  This is my understanding as well.

One point, which is a confusing one.  Despite what the VFS man page may say (at least the version I linked earlier, search for "http"), the read mode is empty string, not "r", coming from VFS to the user-supplied open command.  Oh, also there's no "r+".  In my opinion, "Properly decoding the mode argument" is much harder than it has to be.