Would those capabilities turned on for the container help affect in any way the node, in case the container gets rooted ? In other words, can those extra added capabilities for the container represent a security hole ( for the container and/or node )?

I'm thinking that even without running OpenVZ, on a normal [ for example ] Ubuntu installation those capabilities are required by the ftp server and people don't panic that much about it.