error.php is the default template of the error page in the root of the content directory. It is used if no plugin stopped execution (for example with a route) and the page was not found. So yes, it’s a 404 error page. You don’t need to modify the HTTP status code, as it’s always set to 404 in that case.
HTTP 500 is not handled by error.php, because it’s thrown if something goes very wrong. Normally this should not happen, so you don’t need a custom error page for that. If you really do, you can use the Apache ErrorDocument directive for that and serve a static error page.
That depends on your implementation and use-case. Do you want to handle these kinds of errors in routes, plugins or in templates directly? Or to be more general: When are the errors thrown?
If you have control over the place the errors are thrown and you aren’t already in the template, you can use site()->visit('error'); to select the error page. Your error page will need to contain the logic to send the appropriate status code though.