I can’t speak for the first four questions, but with your fifth…
Card Not Present transactions (those done remotely), such as the Top Up functionality, do not require the CVV.
The only details actually needed by any entity for these transactions are the card number and expiry date. It is up to the merchant to utilise Card Name, Address and CVV.
So Monzo do not need to store your CVV for the top up functionality to work. If through their other means of verification, they are sure the card belongs to you (like asking for CVV on the first top up), they can choose to not test it again.