On top of this keychain stores logins by domain. Even if an app is in a different developer’s container you can retrieve the credentials with just a couple taps.

I didn't know that, can they share logins across apps?

E.g. if I'm logged into Google Spreadsheets, am I also logged into Google Docs automatically?

See here for details: https://developer.apple.com/documentation/security/keychain_...

Yes all apps by the same developer have a shared container.

Yes, exactly.