1. The device sends data in response to IN token packets from the host. If it's an interrupt endpoint, the host will send periodic IN token packets. If it's a bulk or control endpoint, an application can cause the driver to request data, for example, by requesting to read a file from a device.
2. Yes, the host must have a way of knowing about any changes the device makes to the media's contents. When the device has control of the media, device firmware can set the SENSE KEY field to NOT READY and set ASC and ASCQ to MEDIUM NOT PRESENT. After accessing the media on its own (not by host request), the device firmware can generate a SCSI UNIT ATTENTION condition of NOT READY TO READY CHANGE, MEDIUM MAY HAVE CHANGED. My USB Mass Storage book has more about these other SCSI conditions and commands.
Jan