1. Yes, a datatap creates a wireless access point into a hardwired system. If a street sam hardwires a datatap into a device, the hacker can access it remotely (with standard Noise penalties for distance, interference, etc. — see SR5 p.231). I'd make attaching the datatap a Hardware + Logic vs. Device Rating x 2 Opposed Test.
2a. Yes, cyberware (including a Datajack or Datajack Plus) has a device rating (see SR5 p.421), which includes Data Processing and Firewall attributes. The rules for a Datajack Plus (Kill Code, p.65) state that it can run programs, but not that it can form a persona. You still need a commlink, cyberdeck, RCC, or similar device for that.
2b. Kill Code says the D-Plus can run programs with a commlink, but it would have to be relevant to an ability the commlink has. For example, the D-Plus could run Encryption or Toolbox to boost a commlink's Firewall or Data Processing attributes, but not Decryption or Stealth, because a commlink simply doesn't have an Attack or Sleaze attribute to boost.
3. Agreed. It should be a Simple Action to remove a dongle, another Simple Action to attach a new one. Not something you could do in VR.