benefit of using [md5] over [trust] authentication for local Unix sockets
For Question 1: using md5 auth for local connections is particularly helpful when you have a multi-user machine, or if you might add additional user accounts for friends/family/coworkers/whoever someday.

If you are and will remain the only actual user on your system, there is less benefit, but it could still be useful: suppose some bad guy manages to break into some system account like 'www'. He may not be able to do a whole lot from that account without root privileges. But if you've left your pg_hba.conf open to 'trust' all local users, the bad guy can do anything to your database, probably including taking over the 'postgres' user account as well, and moving on to attempt to root your system, steal your data, or whatever from there.

For Question 2: You could use a .pgpass file with, say, only a 'readonly' user's credentials, so if a bad buy took over that account he wouldn't have superuser-level access to the database. If you do store the password for the postgres user in your ~/.pgpass, then yes, it would be "game over" for your postgres instance if a bad guy took over that local user account. Again, that documentation was written with the possible use-case of a multi-user machine in mind, e.g. different local users might have or use various Postgres user accounts, not necessarily superuser accounts.