By approving the smart contracts, MetaMask keeps your wallet data in order to see it. An Ethereum address is a unique identifier that serves as tokeens virtual location for your Ether and other tokens; think to have full control over account number.
Make sure to keep BOTH your Secret Recovery Phrase and private keys for any accounts not derived from your Secret Recovery Phrase, such as imported accounts securely stored to recover all your accounts. ERC tokens are deployed with functionality that allows other smart contracts to move tokens. Yes, although currently only on MetaMask Mobile.
