#4 should be qualified to point out that if someone gets a copy of the private keys on the paper wallet, they can steal the coins.
Because the address can be derived via the private key as demo'd on the bitaddress.org website?
Because using the private key, that's how you spend the funds... (and yes, the address can be derived from the private key)