Allowing third-party modules to alter the query executed by a module
Not really sure what your question exactly is now.


I'm not sure why hook_query_alter() even exists, it did not in the beginning. I don't think that hook makes much sense, I can't think of a use case where you want to alter every query.
If you expect that other modules want to extend your query, then use "->addTag('yourmodule_tag')" so that it is possible to alter it. As you already said, this only covers cases where the same existing query should be changed. It might be possible to do other checks and then add a condition that can never be true (like 1 = 0) on the query, but that sounds hacky to me.
You can also define your own hook if you think that there could be more complex checks that other modules want to do. You probably want to re-use the hook_node_access pattern with three possible return values (ignore, allow, deny), see node_access().


You can do either or both of these two things, hook calls are rather fast in D7 because the hook implementations are cached and don't need to re-checked every time the hook is invoked.