Good questions. I guess for eventual publishing, the app repository fees need to be paid indeed. That only applies to development and not security testing though.
There are some cases like free-software where you wouldn't need the app store.
What's the point of making iOS software then? Just compile it for whatever platform one would run the emulator on. If I understand your comment correctly.
Two factor is a challenge with development (for IAP sandbox) accounts. I have to be careful to constantly not turn on two factor for test accounts. The iPhone will keep prompting me to opt-in, but I don't have several spare phone numbers or '2nd Apple' trusted devices for 2FA.
Apple's 2FA details: https://support.apple.com/guide/iphone/manage-factor-authent...
While I support 2FA usage, I wish there was a way to say 'I understand the risks and do not want 2FA on this account'.
And doesn't it phone home and report you?