What arguments does a _custom_access callback exactly receive?
See \Drupal\Core\Access\AccessArgumentsResolverFactory::getArgumentsResolver() which is called by your snippet above to create the argument resolver, I think that covers it pretty well.

It gets all raw parameters, all possibly upcasted parameters, plus request, route match and account. The access callback receives the arguments from that list, based on the names and type hints.

So account isn't ignored.

That logic is the same as for any other access check, the whole point of _custom_access is to have an easy way to do a one-off access check without having to go through the additional steps of a service that's defined with a special tag.