Question:
Shouldn't thisdev firewall be loaded in DEV environment only? (i.e. under something likewhen@dev)

The security config is not merged between environments. So you would have to repeat everything for thedev environment.

Is this true forall parts of the config?
Cause athttps://symfony.com/doc/current/security/passwords.html#configuring-a-password-hasher (green box) it's recommended to reconfigure the password hasher inconfig/packages/test/security.php, and I did this inconfig/packages/security.php like this:

if ('test' ===$containerConfigurator->env()) {// ...}

Is this true for all parts of the config?

Not to all parts, and some parts behave differently. We don't merge configuration fromsecurity.role_hierarchy andsecurity.password_hashers, and we don't allow new items insecurity.firewalls (i.e. you may change options of the firewalls, but you can't add new firewalls).

About this PR, I think it makes sense, but let's wait for the recipe to be accepted as the documentation have to be in sync with the generated recipes.