Do they mean per Packaged Profile?
Yes. If you're not packaging profiles, you only need to have the bare minimum users. These will typically be Admin and Standard User. Your code should run just fine in both configurations.
Can, do and should we Package Profiles at all?
Yes, no, and no. We can package profiles, but we shouldn't. Salesforce.com has been hard at work reducing/eliminating the need for profiles, and there is a planned deprecation of profiles at some point in the future (Safe Harbor and all that).
Is there a agreed on Best Practice for packaging a User and Admin Permission Set instead?
Yes. Using Permission Sets and/or Permission Set Groups is the intended forward path for all apps, as the basic principle is that permissions may eventually disappear from profiles completely, leaving only things like page layout assignments and other things that would be hard to emulate with only Permission Sets.
I don't want to copy the entire article, but Introducing The Next Generation of User Management: Permission Set Groups from 2019 introduced the concept that salesforce.com is actively working on making Permission Sets and Permission Set Groups the standard for most features.
Here's a graphic of what salesforce.com is recommending for moving to Permission Sets.
They've also noted things that they'd like to do to make the process easier to use Permission Sets:
- Allow assignment of FLS to perm set when creating a field
- Tools to identify where profile is referenced, locating profile names in code and configurations
- Migration path for profile reference in custom settings
- Allow permission sets or permission set groups mapping when installing managed package
So, we should focus on moving away from profiles. They are still "necessary" today, but modern packages should focus on Permission Set-based access policies in order to future-proof our products.
