On (1), yes that is true to an extent - the domain discoverability is indeed mostly at the mercy of Google, and the whole "AI overview" is a garbage experience. However, looking at my own search console data (both Google and Bing), there are still quite a few folks landing on my pages through search, often for some obscure terms that I somehow documented, so it's still possible to get traffic that way. But again - the goal is less about "drive traffic ASAP" but rather point people from other networks to something you personally own.
On (2), they can, but if you use a more established provider like Buttondown or Mailchimp, and you are not actually sending spam, a lot of folks have quite a bit of success building an audience that way. I've used Buttondown (not affiliated with them in any capacity) personally before and haven't had subscribers complain about deliverability. I am planning on rebooting that this year to see how it goes. I've heard most deliverability issues arise when folks trying to roll out their own email server.