Need help understanding global settings for code security

[piotrekkr]

Select Topic Area

Question

Body

I need some help with understanding how some setting for organizations work. This is how organization settings look like:

And to be honest I don't really understand much of what is going on there. Here are my questions:

1. Based on this config screen seems to me like dependabot is enabled on all repos in organizations even without using dependabot.yaml? Is this correct? If not would those apply only if there is dependabot.yaml?
2. Grouped security updates - What happens if I check/uncheck this setting? Will it enable grouping on all repos inside organization? Will it enable grouping even if I have dependabot.yaml inside defined but without any settings related to grouping inside?
3. Automatically enable for new repositories - This setting is really close to Dependabot on self-hosted runners so my guess is that it is for just self hosted runners. Am I correct or is it for both Actions runners and self-hosted? Or maybe this is to enable dependabot but somehow misplaced?
4. Recommend the extended query suite for repositories enabling default setup - What does this do exactly? Where will I see this recommendation?

In general would be nice if GitHub added links to docs with each option explaining what it actually does.

Thanks

// EDIT

Found some documentation explaining a bit but then I read this:

Granting Dependabot access to private repositories

To update private dependencies of repositories in your organization, Dependabot needs access to those repositories. To grant Dependabot access to the desired private repository, scroll down to the "Grant Dependabot access to private repositories" section, then use the search bar to find and select the desired repository. Be aware that granting Dependabot access to a repository means all users in your organization will have access to the contents of that repository through Dependabot updates. For more information about the supported ecosystems for private repositories, see "About Dependabot version updates."

and I cannot find this in global settings in organization. Any clue where can I find this?