STM32F4 boot concepts and vector table relocation
Question 1:

I can't definitely answer your first question. But in the programming manual where the VTOR register is described (page 212) it states that bit 29 is used to determine where the vector table is located, either in the code region (0) or in the SRAM region (1).

Now I don't understand why this has to be done for the same reason you state, the SRAM gets aliased to 0x0, so why is there a need to set this offset?

The only guess I have is stated on your cited page 69. They say:


  the code area starts from address 0x0000 0000 (accessed
  through the ICode/DCode buses)
  
  the data area (SRAM) starts from address
  0x2000 0000 (accessed through the system bus)
  
  The Cortex ® -M4 with FPU CPU always
  fetches the reset vector on the ICode bus


Maybe on an interrupt the ICode bus is used, which cannot access the SRAM even when remapped (I don't know if this is true). This would explain why this bit has to be set accordingly, telling the core to use the system bus and access the SRAM.

Question 2:

While it might be true, that the SRAM is empty on the first boot of the device, it isn't necessarily for later boots. So you could create something like a battery powered device which gets its SRAM programmed during production and then runs until the battery is dead, which would clear its SRAM. I guess this would make reverse engineering the device a bit harder.

In a battery powered device you would probably use the standby mode to conserve power, and if you leave that mode, the Boot-pins are sampled again, so they must have the correct setting to get to the SRAM again.

You can also reboot the device safely as the content of the SRAM doesn't get destroyed if there is no power outtake.

Not a very convincing application to rectify all the trouble to remap the SRAM.