Can simulateConcurrentUsage run with sim users whose role was changed from Service Admin?

testMode=1 creates <testName>UserN users with the Service Administrator role. We'd like to use these simulator-managed users to regression-test non-admin security without maintaining passwords for native accounts (testMode=4 / users.csv).

Planned approach: create one testName per security persona, change each user to the User role, add them to Planning security groups, then run testMode=3.

Questions:
Is changing roles on testMode=1 users supported, and will testMode=3 still run?

Does testMode=3 enforce the user's application security, or bypass it?

Does testMode=3 ever restore the Service Administrator role?

How does testMode=3 assign users to operations when the package needs fewer users than the testName contains?