Balances are read from chain, not from FLOW's database.
Solana returns the 20 largest token accounts. They are grouped by owner, so a wallet with several accounts shows once and the list can be shorter than 20.
% of supply uses the token's current total supply. Burned tokens are already out of it.
Program and pool accounts are labelled. They can't sign a deal, so they can't receive a private offer.
FLOW doesn't notify holders. After you create a private offer, send the deal link to the holder yourself.