Correct analysis for "Mismatched entity and/or field definitions"
Thanks to 4k4 and Clive and following the link I think I can now write up the answer to my question.


This Drupal Change Record (and more detail) documents that
module developers should write hook_update functions for entity updates. 
So if you get the "mismatched" warning after a contrib module update
then it's a bug in that module and you should not apply to update to the live site.
This question explains that entity-updates is a developer tool. 
If you are a developer working on a test site you may see the
"mismatched" warning whilst making changes.  You will run
entity-updates when you are ready.


So the answer to my questions 2 and 3 is no.