You're right: missing TLS is a far greater problem than just modifying the login form's action. Have a look at the full paragraph from the link you provided:
The login page and all subsequent authenticated pages must be exclusively accessed over TLS. The initial login page, referred to as the "login landing page", must be served over TLS. Failure to utilize TLS for the login landing page allows an attacker to modify the login form action, causing the user's credentials to be posted to an arbitrary location. Failure to utilize TLS for authenticated pages after the login enables an attacker to view the unencrypted session ID and compromise the user's authenticated session
As @user2313067 points out, OWASP is providing addressing a common misconception "that by setting https in the action of the formon an http page, you have no guarantee that the client will receive it unmodified, and it might point to a page the attacker controls. Putting https on subsequent pages but not on the login form only protects you against passive attacks"
payloads an attacker might deliver because there was no TLS.
Specifically to answer your questions:
- Yes, the password is exposed if you fail to use TLS.
- Internet traffic is not guaranteed to take any particular route across the Internet - one packet can go one way and the next packet can go through totally different networks. Changing the form action avoids the risk that the victim's password will go over a different network and the attacker won't be able to intercept it. Of course, this is really not necessary to understand why missing crypto is important or the basics of how network traffic interception works; it adds complexity to the particular discussion in question without need. It could be better discussed on a different page. But then OWASP is free, volunteer driven, and doesn't seem to rigorously enforce any real organization to what content goes on what page.
- Yes. If network traffic is not encrypted with strong crypto then it can be modified in flight. There are two main ways to do this. First, the attacker proxies the connection better you and the server. You are now talking to the attacker. The attacker can send you anything they want. Second, the attacker sees the response from the server as it travels in the clear over the network and replaces it with their own response. Your computer cannot tell the difference between the valid response and the malicious response so it just trusts the first response it receives. The attacker pays tricks to make sure its response is received first and you get the (part of the) page returned by the attacker not by the server.