The number of questions on SO related to iBeacon and its background capabilities is increasing and there is some confusion on that point. I have been testing the AirLocate p
Sounds like you are on the right track. In general you are correct that an app needs to be in the foreground to fully use iBeacon capabilities. A few specifics on your three main questions:
Your mall use case can work with a couple of limitations. (a) you have to conserve your CLBeaconRegions by having many or all 100 stores share the same UUID and/or major number, differing only in the minor number. This allows you to set up a single CLBeaconRegion to monitor many. (b) If the app wakes up into the background from seeing iBeacon 1, it won't be able to wake up a second time from seeing iBeacon 2 in the same CLBeaconRegion unless it first stops seeing any other beacon in that CLBeaconRegion. (You can game this a bit by setting up several CLBeaconRegions and trying group stores so adjacent ones in the overlapping 50 meter bluetooth radio range are in different CLBeaconRegions.)
No, a store owner cannot use their iPad act as an iBeacon in the background -- it has to be in the foreground to work. But they can have their Windows or Mac computer do this using a virtual iBeacon program. My company offers one for free download: http://developer.radiusnetworks.com/ibeacon/
In the door entry use case, yes, the user would have to acknowledge the notification on the lock screen to bring the app into the foreground. A typical implementation would use a single CLBeaconRegion (probably with all iBeacons sharing a ProximityUUID and maybe even a major) to alert the user.
Edit 4/11/2020: Apple announced plans for a new beacon advertisement that will work in the background. See here for more info.