I mean, come on. The vast majority of services that have apps running on TV implemented QR code based login workflow ages ago, and it just works. For Xbox, logging in is always a struggle.
It does but it's not reliable. The update process is also the slowest imaginable other than Windows update. It takes several minutes at times just to discover which games need updates.
It probably does, but it's turned off the majority of time. It's still plugged in, so I wouldn't mind if it updated itself silently, but no, it does not do it when it's turned off.