The steam API allows servers to verify a player owns the game and provides a server list. Actual networking once players are connected isn't part of its scope iirc.

Don't know, but it doesn't really matter. Player segregation would be a clause in a contract between Activision and Valve first and foremost. How it's technically implemented is secondary.

Probably, a big factor could be the anticheat stuff - without the steam client inspecting game state, Microsoft store players could get away with aim bots or other exploits