What Does ‘l2protocol peer x’ Do?

Under normal conditions only the root ID and bridge priority of the VPC primary will be sent via VPC downstream links. Within VPC links only the operational primary transmits or processes BPDU's (nb - the secondary forwards rather than proxies). In the case of non-VPC links the actual ID's and priorities will be sent, thus allowing STP to continue to function as expected.

Best practice is that the lower (better) root priority should be on the VPC primary. If it isn't the case and the seondary has a better priority then downstream VPC connections will still receive the ID and priority of the VPC primary - even though it's the worse of the two.

If the VPC primary fails (loss of peer link + peer keepalive) then the VPC operational role shifts as the VPC secondary assumes the role of primary. In this instance you are correct that a new root bridge has appeared and STP needs to run throughout the topology - with attendant interruption of service. This is where the peer-switch feature comes in...

When enabled the peer-switch command actually causes the two VPC paired switches to create a third (common) virtual root ID that should always have the lowest priority in the topology. This means that both switches are going to send BPDU's with the virtual ID as the root of the topology and their respective physical bridge ID's as the candidate for designated forwarder.

So - Any downstream non-VPC switch will see a common root ID and two potential candidates for designated forwarder with distinct ID's but identical priorities (nb - strong suggestion that VLAN STP priorities be equal on VPC peers) and will pick accordingly (..generally choosing the lower bridge ID).

For VPC downstream switches the BPDU created by the VPC primary will just see a neighbor of the new virtual root address. In the event of a failure the secondary will maintain the identical advertisement - same ID, same priority... so zero STP convergence required.

The Nexus switch will use the vPC link as a normal layer 2 trunk if it's the only way to get the traffic to the destination. Cisco has made the Nexus with the intent to prevent bridge forwarding looping and duplicate packets, to make Layer 2 work correctly without needing Spanning Tree Protocol (STP) to do so.

The exception is, if the end hosts are individually connected to either one of the Nexus switches without any redundancy. In your case, if the primary firewall is only connected to one of the Nexus switches, then it will utilize the vPC link to carry traffic to it.

vPC technology provides sharing of: Control plane, configuration and consistency check, vPC advertisements, Spanning-tree, HSRP, IGMP and MAC address tables. All this information is encapsulated in standard Ethernet frames and only sent out on the vPC link. All frames are tagged CoS = 4 for reliable communication.

Good read: https://www.netcraftsmen.com/how-vpc-works/

Cisco official vPC design guide document for all Nexus switches: https://www.cisco.com/c/dam/en/us/td/docs/switches/datacenter/sw/design/vpc_design/vpc_best_practices_design_guide.pdf