How does this battery protection IC prevent overcharge/overdischarge?
It looks like all three ICs complement each other. The MP2615 is CC-CV charger with overCHARGE limit at 10% of CC. The BQ29209 provides cell balancing and secondary overVOLTAGE protection. The S-8261 provides current limit during discharge, and overDISCHARGE protection, and the secondary overcharge (voltage cut-off at diminishing current) comes as a bonus.

What's the point of driving the motor directly from VBAT? Likely a better overall efficiency, to avoid losses in DC-DC conversion.