You can patch sig checks in sysNAND without using redNAND at all, correct. You still need a way to launch a custom fw.bin though, i.e. Internet Browser exploit.
Yes you can, no it does not brick or delete the fakesigned content.
It doesn't, really, or at least it doesn't care unless you try to...