Not quite-- NODE_NETWORK exists, and is absolutely required for outbound connections (e.g. doesn't even get the bypass for draws; also the 40 count isn't 40 connection attempts, it's 40 results from addrman (which could be connection attempts or rejected for other reasons)).

In whatever release that comes out after segwit is required NODE_WITNESS will become required just like NODE_NETWORK is.   The purpose of outbound connections is to make sure you aren't partitioned and can obtain blocks, they're for your own benefit. Inbound connections are for the benefit of others.

It's not acceptable for the network topology to suddenly change when segwit activates--  can you imagine that? drop all your current connections and then form new ones hoping that the network can make a non-partitioned graph?-- that would be irresponsible.  Instead, it changes its connection preference at install time, so if there were any issues they could be addressed while the user is paying attention.

If you addnode a non-witness peer, it will be accepted just fine. Any inbound non-witness peers are accepted fine. If it's not able to get connected to witness peers it'll connect out to up to 4 of them so to avoid being partitioned if there are no witness peers available. It isn't "blacklisting" in any form-- my own 0.13.1 nodes have 82 out of 118 and  71 out of 113 peers which are not 0.13.1. (and in the latter group one of those 71 is an outbound connection to a 0.12.1 peer, FWIW).

None of it impedes the ability of non-segwit nodes to operate.  This was discussed in several public meetings and documented. I'm not aware of any problems resulting from it, besides the usual giving Kano something to howl abusively about.   When Bitcoin XT merged "xthin" it incorporated something far more aggressive (an absolute prohibition on outbound connections to non-xthin peers, even if addnoded, even if the node was partitioned)-- yet as far as I can tell there has been narry a complaint from Kano about it.