If true then this dependency is either a development dependency ONLY of the top level module or a transitive dependency of one. This is false for dependencies that are both a development dependency of the top level and a transitive dependency of a non-development dependency of the top level.
I think this paragraph tries to illustrate how the package dependency's dev: true is assigned.
Directly development dependency -> dev: true
With only indirect development dependency -> dev: true
Directly development dependency however
it also has indirect non-develop dependency -> no "dev: true"
In other words, once a develop dependency package is indirectly dependent by a non-development package, it shall be dev: false and thus it will be included in the build process. The purpose of this rule is to make sure that packages needed by the non-develop package will not have "dev: true".
Besides, if install via "npm install -D , then the package will be installed as the develop package thus no "dev: true" changes may occur. However, if install via "npm install ", this may remove many existing dependencies' "dev: true" attribute.
For example, I run "npm install -D bestzip" in my project and the ressult is:
53 dependencies with "dev": true added
Run "npm install bestzip" and the result is:
53 dependencies without "dev": true added
43 existing dependencies' "dev": true attribute are removed
So answering your first question, "dev": true in package-lock.json means this dependency won't be installed by npm install/npm ci when running in production mode.
Having dependencies used only for local development environment marked with "dev": true and then using --production in your CI might save you some build time.