Okay, so I can use type=peer for any kind of peers and it will be fine.
And a bug, maybe related to this peer/friend thing. On * machine I have [1234567] password-protected account for test purposes and I also can dial “thru” this * machine with same CID 1234567, but from “trunk” peer from another PBX. And… call is routed by Asterisk like it came from password-protected peer, with it’s context and other settings. What’s this?