A couple of years ago there was also a lower adoption of html5 elements. Having one h1 tag per page is still a good Idea in general, but it is allowable to have one h1 tag per containing article tag as well. Since this theme does not seem to use tags like article and aside (that I've seen in my quick check) I agree that there should only be one h1 tag per page which contains the page title or headline. The theme structure is otherwise good, but could definitely use with some contextual revamping of quite a few divs.
Permissions for a custom page
Is it possible to setup permissions for a custom static page?
I have limited it so users must be logged in to see the link on my header, but if they save this as a bookmark or remember the URL, that can bypass requiring to login
I would like to set user must be logged in to see the content on page
I don't think so. This is something to bring up on the plugin's Github page.