1 and 3 are not true anymore, the new canonical CMake way is targets with attached dependencies, header file search paths, compiler flags and possibly other things. Bad documentation - well yeah, it's specifically missing first-party best practices and howto documentation and the third-party documentation as well as really old first-party documentation in the CMake wiki often recommends bad old practices.

You forgot to mention that the language is awful (but that usually doesn't get in the way IME).