Don't know if you got this answered but you can swap 3 times a year (MS support can reset it) and no they can't take anything from you the only thing they get is access to your games without being logged in as you but obviously they have full access to your account so they could still buy stuff.
Yes they can if they know the password. Thats why there is 2 step verification. But then if whoever was sharing was smart the would turn off the "able to purchase anything" option on the account.
