1- account is created after signing up. There is indeed a glitch- where before the person confirms their email, their status goes to ‘account’ instead of staying as unauthenticated. Profile- is after the person has created their profile. These two should not have same permissions. I have kept account very very limited as I realized that someone becomes account without even confirming their email. I also went individually to page blocks to specify permissions to add even more restrictions.

2- that’s what I did. I have very limited permissions for Account

3- because of the glitch in the platform, I think as long as a user signs up, they are automatically taken to select their profile. I don’t think this is terrible because it encourages members to create their profile but if you restrict permissions in Account, they will eventually create their profile which is exactly what you want anyway.