Hi Thanks for the question
For #1 - this is not really about APIM but generally about cache control headers work which APIM supports in its position as a Layer7 [reverse] proxy. The following SO post indirectly explains it https://stackoverflow.com/questions/3339859/what-is-the-risk-of-having-http-header-cache-control-public
Incidentally, the terms "downstream" and "upstream" in context can be confusing - that's discussed in blogs, but this SO post is a good reference https://stackoverflow.com/questions/32364579/upstream-downstream-terminology-used-backwards-e-g-nginx
for #2
As per docs "allow-private-request-caching" is simply saying "you can cache if an auth header is present" whereas vary-by is a bit more complex. These are two different things.
For a reasonable deep dive into vary see this https://www.smashingmagazine.com/2017/11/understanding-vary-header/