See the source code on that:
- https://letsencrypt.pep.foundation/trac/browser/asn.1
- https://letsencrypt.pep.foundation/trac/browser/sync
As you say correctly, of course you've to take care: as a common denominator an id is used, in case of e-mail a certain mail address, whose e-mail channel for communicaion functions as the key exchange channel, too (meaning the devices send themselves messages ("beacons"), which are considered as technical messages by the p≡p engine and thus never shown to the user as such).
=> If you fear to have a cell phone hacked or lost, it's better to not put that in a device group. Also you can seperate business from private accounts or have different accounts and on top of that aliases for whatever purposes, referencing the same id (mail address). In short: you can have (like mostly today) no device group at all or just different device groups meeting your needs and "paranoia levels" (based on the trust you put in your devices).
The devices agree on a device group key pair, being the master key pair, still they sync all devices' private keys for that specific id, such that you can read all of your messages received on all of your devices (even if there were changing pubkeys in between used for encryption, because of your different devices, which were not yet synced in the past).
If a device is lost or stolen, that has to be manually signalized by one of the other devices in the device group and then the devices have to agree on an new device group key pair to encrypt their future communications (we're talking of PGP encryption here, so no forwad secrecy).
If I only have one key for everything, it's quite dangerous for the key, because it must be on all my devices. If I create a key for each device though, how do you know which key to use? And the more keys I create the more I need to remember which is for which, when to replace one, etc. Last but not least it is REALLY HARD to erase stuff from smartphone memory. So the moment you put your key there you should know that other people will get their hands on, read your decryptet emails on the phone etc. There must be a way for me to kill it without completely erasing it, or at least a best practice for how to handle that.
Altogether I don't feel like PGP is meant for the 21st century. Or I just am not not smart enough to figure out how to make it work. I always spent a lot of time on it, and wasn't able to read all my email whenever I needed.