Question 1:
I can't definitely answer your first question. But in the programming manual where the VTOR register is described (page 212) it states that bit 29 is used to determine where the vector table is located, either in the code region (0) or in the SRAM region (1).
Now I don't understand why this has to be done for the same reason you state, the SRAM gets aliased to 0x0, so why is there a need to set this offset?
The only guess I have is stated on your cited page 69. They say:
the code area starts from address 0x0000 0000 (accessed
through the ICode/DCode buses)
the data area (SRAM) starts from address
0x2000 0000 (accessed through the system bus)
The Cortex ® -M4 with FPU CPU always
fetches the reset vector on the ICode bus
Maybe on an interrupt the ICode bus is used, which cannot access the SRAM even when remapped (I don't know if this is true). This would explain why this bit has to be set accordingly, telling the core to use the system bus and access the SRAM.
Question 2:
While it might be true, that the SRAM is empty on the first boot of the device, it isn't necessarily for later boots. So you could create something like a battery powered device which gets its SRAM programmed during production and then runs until the battery is dead, which would clear its SRAM. I guess this would make reverse engineering the device a bit harder.
In a battery powered device you would probably use the standby mode to conserve power, and if you leave that mode, the Boot-pins are sampled again, so they must have the correct setting to get to the SRAM again.
You can also reboot the device safely as the content of the SRAM doesn't get destroyed if there is no power outtake.
Not a very convincing application to rectify all the trouble to remap the SRAM.
I strongly recommend the libraries. A big advantage of cortex M is to be able to easily move your code to other members of the same family (i.e. STMF0 to STMF4), or even to different manufacturers, and you lose this advantage if you don't use the libraries.
BTW, many vendor specific libraries are CMSIS compliant.
I've avoided families that don't supply CMSIS compliant libraries. Also, I've not tried STM Cube for much the same reasons.
Best Answer
With reference to the v7 reference manual for the STM32F407, table 61 on p369 contains the list of interrupt vectors and their bit position (0-255) in the NVIC_ISER/ICER registers.