Mostly correct, except for a few points:

1. RDP2 completely disables the debug interface. The microcontroller doesn't respond to debug requests in this mode.

2. As the third attack requires the microcontroller to have a working debug port, it requires it to be in RDP1. (Which could be accomplished using the second attack.)