Did I read posting key correctly? Does it mean that any account having posting authority on another account, which is quite frequent, could drain its RC?

Yes, although not all of it. We went back and forth with this (active vs posting) and in the end we felt that it was more important to enable all the L2 solutions like RC trailing, RC pools etc than to lock it because it requires active.

Realistically there's much worse things that can be done with posting authority than just delegating RC away (downvoting everyone / posting spam everywhere that can't be deleted etc etc). And those don't happen even though the risk has always been there, so we felt like it's an okay tradeoff.

Worst comes to worst, RC is non-consensus so we can change this without a hard fork.

You can delegate to 100 accounts at once.

What I mean is you can delegate up to 100 accounts in a single op.