Hi,
2. This should come soon.
3. I just tried to set it on my end and it's working fine, the created user is well restricted to only the mass action part.
He can see the products via Components > HikaShop > Products but can't do anything else than exporting the data.
Same thing for the other things.
Thanks to check again the restriction settings, and be sure that the created user is not in another user group.
If you are still not able to restrict correctly, thanks to provide a screenshot of the user > group settings,groups, and HikaShop ACLs.