It is indeed total ass. Reporting from the ground here, mobile internet is effectively dead - cloudflare is banned and most vpn protocols are cut after 20kb. There are still ways, like ssh forwarding, amnezia and zapret, but the trend is towards blocking all encrypted traffic going abroad. Complete outages are also common as well.

Wired is a bit better, I see disruptions frequently between my ru and non-ru nodes, but it's usually between two hosts and relayable, no complete ban like on mobile.

Max is on track of becoming mandatory. It already is for school students and their parents. Gosuslugi (gov services) already show an option to use it for auth, there are alrwady deeper integrations on the way that would make it a requirement.

It is pretty openly spied upon. I'm not touching that shit with a six foot pole, but there were already arrests over things said in voice-calls and I've even heard reports of FSB agents interjecting right in the middle of the call, saying they're being too annoying and force-hanging the call.