Hosted RPA bots/Hosted Machine Groups are managed by MS (although you can use a custom image). They are only virtual. (Non-hosted) Machine Groups, are machines managed by you, they can be physical or virual. Hosted Machine Groups allow you to better manage your pool of machines. In order to alter the machines available in a non-hosted machine group, you would need to log into the machines and manually change their groups. Not to mention Create new machines if you are just increasing your machine pool. This maybe pretty streamlined, especially with virtual machines, but for Hosted Machine groups, you can just alter the Group Size and your done.

azure key vault to store several credentials, 1 record for each in a table in your prefered database and good old FIFO implementation to use them. A flow "locks" the credential when starting and before finishing "unlocks" it. you need to have good error handling and monitoring.

First run takes a bit more time to provision and initialize the VM

For anyone reading this, do not go that way. It has a known error at a key task that makes it unusable and MS is NOT giving it support since now you have hosted RPA