Q: The maxFeatures filter does not seem to get passed to the underlying database. Are all feature being requested?

No, the whole table is not requested.
GeoServer streams data from the JDBC connections, tables are so big that it's basically impossible for us to do anything that would load a whole table in to memory. So the maximum number of extra rows that you'll get loading up is the Fetch Size for the database. I think for PostGIS it's about 200 rows at a time, and I imagine Oracle's about the same. Since there's really not a ton of overhead, we didn't bother with the step to pass the maxfeatures back to the database. But I don't believe there's much overhead to just closing the pointer to the results in the db when you're done using it.