1) This is incorrect. They should be pretty easily customizable with our tools if you know how to use them at all or if you read the help documentation provided.
2) You need to use Universal Email and dataAssist to do this. I think there is a tutorial or recipe included with security assist on this topic.
3) No way to create the captcha or security question itself. But all you have to do is copy and paste them and they can be added to any page... and it does use the WebAssist validation toolkit to do the actual validation, which can be applied to the pages you copied and pasted to for the full functionality.