Sorry for the delayed response.
Mobius is unusual as a plugin for several reasons. First, it is also a standalone application so it needs to be able to save state that is independent of any host. Second, it has hundreds of parameters (a few dozen times the number of tracks you have configured) which is more than hosts can save. So Mobius saves state in its Session on the file system. You can configure a few parameters to be exposed to the host and saved with whatever the host uses to save state, but it's awkward to set up, and not really necessary.
The crucial missing piece, which I think we've talked about before, is that it is not currently possible to save the current session with the host state. So when you load a host project, Mobius will continue using whatever is selected as the startup session. There needs to be a way to save the currently active session with the host project. Most plugins call this a preset. I'm working on a way to do that. You will still need to create several Mobius sessions for each host project though.
For 2, this could mean two things. Sending MIDI to the host to be routed to a virtual instrument, or sending MIDI that is intercepted by the host for host control.
In the first case, this is the normal case for MIDI tracks, they send events through the VST3 midi channel, and you use host routing to send those to an instrument.
In the second case, you will need to use a loopback device. There is nothing in the VST3 spec that allows a plugin to control random things in the host, and every host has different ways to respond to MIDI (and some don't allow it at all). You would use scripts to send MIDI events to a loopback device, then configure the host to receive from that device, and you have to code into the script the MIDI events your particular host recognizes. That's really the best we can do, as there are no standards around this. A few hosts offer more control beyond the VST3 spec, Reaper extensions for example, but I try not to do anything host specific since not everyone can make use of it.
So 1 is coming in the form of saving the active session with the host project, and 2 is already there if I understand correctly.