Updating the BIOS does carry some risk, as you can potentially brick (ruin) the motherboard. Updating the BIOS is updating the firmware (software) on a chip on the motherboard. Unfortunately this BIOS chip is required to boot the motherboard in any capacity. If the firmware does not update properly, your motherboard is likely bricked and cannot be repaired unless you solder in a new BIOS chip on the motherboard (very few people have the capability to do this).
I feel that updating the BIOS from a Bootable CD is safer than updating from Windows. In all my various ThinkPads (including my X220), I have updated the BIOS's perhaps 2 dozen times without incident. Note it is reported that updating the BIOS above version 1.28 on the X220 will throttle memory speeds to 1333. I had to replace the motherboard on my X220 early this year due to a power on problem that developed from a coffee spill on the keyboard. The motherboard I received from ebay had it's BIOS version at 1.26, so I just left it at that version. I since bought new 1866 RAM memory and a SSD hard drive to speed up the laptop. BTW, I am still running Windows 7 on this X220 and do not plan to run Windows 10 on it.
https://forums.lenovo.com/t5/ThinkPad-X-Series-Laptops/X220-newer-BIOS-revisions-do-not-support-memory-speeds-above/td-p/834329
One other thing regarding the X220 BIOS updates. From version 1.42 and upward, the BIOS update cannot be downgraded to a lower version (for security reasons they say).
Whether getting your Bluetooth headphones to work on your X220 is worth updating the BIOS for, I can not say. You might consider getting a bluetooth USB dongle to attach to the X220 which would likely support the latest bluetooth feature set.
Regarding your questions:
1) I do not believe Lenovo will officially support Windows 10 on the X220. So expect that not all features will work as they should.
2) Indeed, updating the BIOS from within Windows 10 while using a Window 8 version would seem like a risky proposition to me. However updating from a Bootable CD would not carry that risk.
3) Read my opening comments.