Actually no, you can send deauth without already knowing the key. It's a good way to force clients onto your rogue AP and then obtain the key via captive portal.

https://www.aircrack-ng.org/doku.php?id=deauthentication

No, that would sort of defeat the purpose. The deauth's are commonly used to try to capture the connection handshake so that one can then (offline) try to figure out the network's password. The management frames (such as deauth) are not encrypted, and one needs only the easily eavesdropped details of client and server MAC to spoof them: https://security.stackexchange.com/questions/190133/why-does...

Depends entirely on the frequency, jurisdiction and purpose.

So is breaking and entering. I doubt most determined thieves are going to be deterred by something being illegal. Your typical junkie isn't going to do that, so you're mostly looking at attackers going after higher end neighborhoods or middle tier business campuses.