I know I've mentioned it with a "make sure you understand the limitations" disclaimer but I'm not finding it immediately either! I am convinced you understand the limitations. Thanks for spelling them out. Performance will also eventually be an issue with many hundreds of entities. You may also want to change settings to limit access to edits and multiple saves.
I don't think there's a strong reason for this and I'm becoming more and more convinced that it's confusing and dangerous.
It's stored in IndexedDB. This is persisted to a browser folder in clear text. It's impractical to access but if the data is sensitive you'll want to make sure the device is secured (which is recommended anyway). True that this is linked to formid, not formid/version so even more reason to change Collect's behavior.
As you've likely noticed, this is what we're working on automating with the Entity concept. You'll specify which entity property to save a form field to. Eventually that will update your local entities as well as the Dataset in Central. You'll be able to continue using choice filters exactly as you have or set an archive condition so that entities that have reached the end of a workflow are no longer transferred to devices.