Questions about ERC20 Tokens

I read UNDERSTAND THE ERC-20 TOKEN SMART CONTRACT and I have a three questions.

1. What actions updates it? I only see a value set at the point of contract creation. My guess will be burn and mint actions (or are there other actions?). Which leads to the second question
2. Why is Mint and Burn not part of the ERC20 interface?
3. The total supply is assigned to balances[msg.sender]. Correct me if I am wrong, but this means the account that deployed the contract basically owns all the tokens at the beginning? Is there not some security worry here? If the private key is compromised that the funds can be moved from it to any other accounts! Has there been cases of exploits that happened because of this? In real life situation how do people handle this security risks? Are there a different kind of ERC20 where supply is spread and held by multiple accounts?