I think you have it pretty much right. It is unfortunate that SoClean is allowed to publish their fear propaganda to the point where CPAP users feel like their are the most irresponsible people on earth for not using their machine (even though CPAP manufacturers do not recommend them). In my view a solution in search of a problem.
The source of contamination is the user of the machine, not the machine, or the water, or to any reasonable extent the air from the room. Non CPAP users breathe the same air. Air on exhale does not go any further back than the mask vent, so the main concern is just cleaning the mask and to a lesser degree the hose and water reservoir.
The water reservoir could be a place for bacteria to grow. Using distilled water does not prevent it, as the distilled water will become contaminated as soon as you open the jug. But, nothing really grows to any extent. Tap water is less likely to grow anything due to the residual chlorine in it. There is no harm in using tap water for short periods of time, and if anything it is safer from a contamination point of view. However, it will have minerals which will build up in the reservoir.
My method of cleaning is to use straight household vinegar. I believe if you dilute it, then it loses the sterilization effect. So my thorough routine for a cleaning is pure vinegar, followed by Dawn dish detergent and water, followed by a tap water rinse, and then hang to drain and dry. Pure vinegar cleans the water reservoir the most effectively because it dissolved any residual minerals.
The machine, deeper than the humidifier, really does not need to be cleaned unless it is going to be recycled to another user, or it is a common use machine in a hospital. The manufacturer does provide a procedure to do a "Reprocessing Disinfection". Way overkill for a user to do it on their own machine though. If you look at the Technical Manual from ResMed on pages 22-26 you will see a description of the process and the disinfectants they recommend. See link below:
Technical Manual