Yeah, so you are spot on what you are saying. What I meant by that statement (regarding a benefit of S2 vs S0) was from a security perspective. They both use AES-128 for encryption so other than during inclusion (the weakness I mentioned), their security “level” is the same.
As far as network performance it is true that S0 sends 3x the amount of traffic than non-secure & S2 send. So that can be an impact on network and even controller performance (since the controller has to do some encryption / decryption). A lot of networks are not impacted by this though if the mesh is strong. I have a lot of S0 devices and never have Z-Wave issues. I’ve found that Hubitat is capable of handling the traffic. I have noticed though that Home Assistant sometimes struggles.
As far as my recommendation I merely recommend using S0 in both cases for compatibility with associations since the bulbs only support S0. If association isn’t necessary then definitely go with S2 vs S0. I’m pretty sure you can’t cross security levels S2 to S0 since they are both using different security keys.