So it is doubly important that all equipment downstream has overvoltage protection?

In fact considering there is no theoretical maximum, it would be downright negligent not to have overvoltage protection

There is a theoretical maximum: the open circuit voltage of a single photovoltaic junction cannot exceed the bandgap of the semiconductor used, no matter how much light you apply. The manufacturer knows the semiconductor used and the number of junctions in series.

The current is what varies proportionally with the amount of light received.

The open-circuit voltage depends mostly on the structure of the solar cells and on the temperature. It has only a very weak (logarithmic) dependence on the amount of light received.

The voltage that you measure at the output depends on the open-circuit voltage, on the amount of light received and on the amount of current that you draw from the panel.

The maximum open circuit voltage for a solar cell is easy to estimate, because it happens at the minimum temperature for which it is designed and the maximum solar illumination. It can be exceeded only using a light concentrator that projects on the panel light collected from a much greater area.

They produce current until the diodes start conducting given the forward voltage, as they'll take any current you don't extract off of your hands.

Of course if you want to extract maximum power you have to balance the higher worth of the current you take against the loss of current to the diode forward conduction.