The underlying system is based of OpenID, basically something like “sign in with google”, “sign with this …”. The system itself is pretty safe so long you ensure that you are on the correct website.
If you aren’t logged into steam before, then yes you will need to give your password to steam(https://store.steampowered.com/).
And yes, this is the only authentication method. Other authentication methods like manual aren’t full-proof nor practical.
That isn’t necessarily true. The system simply works by redirecting you to Steam and asking steam for a list of your games. If your games aren’t public, then it won’t work, thus the reason why it needs to be public. In practice, Steam is overseeing this operation.
Reconfirmation by Steam itself(you see this when you’re about to login):
