How to interpret the code: module_invoke_all('user', 'logout', NULL, $user);?
No, they don't log the user out. That is done by the call to session_destroy() in user_logout().

That line only invokes the hook to tell other modules that the user was just logged out so they can react based on that.

The passed arguments are simply those that match the executed hook. Note that the Drupal 7 version is different from what you posted above, which is the Drupal 6 version.