OPV..?

SPICE is just a numerical integration engine. Anything you can describe in differential equations, you can run in SPICE. Which, since diff eq are Turing complete, and physically fundamental besides, that's anything.

The basic limitation is you only have as many equations or states as there are nodes in the model, and they're scalar only; it's not a field solver, nor is it a general complex/analytic equation solver.

For example, you can't construct the EM field model of a PCB, but you can use a field simulator to extract an equivalent LC model that's good up to some accuracy and frequency limit, and use that in SPICE.

Of course, as the node count goes up, simulation performance drops. It's also tuned for sparse matrices (which is effective for most practical circuits), and a highly coupled circuit might run slower as well.

You can have faster performance if you can describe your device in terms of built-in primitives, like diodes and transistors. This is effective when you're modeling such a component in the first place, but not so effective when you need to get more precise. Say if you want to model the drift step recovery behavior of a diode: SPICE's recovery model is quite basic for starters, and note that recovery is a diffusive transport phenomenon, i.e. a continuum field not a discretized system, so such a phenomenon can only be approximated in SPICE. If you want to go off-label (say, modeling wide bandgap diodes, or do something weird (say, something with a non one-to-one doping profile), you're going to have a harder time. Maybe you can still construct an approximation using an array of such devices, or maybe it's better to fall back on the basic equations.

While SPICE uses voltage and current as intrinsic units, you can simply use the same values to represent whatever you want. A typical example is using voltage to represent temperature, for thermal modeling. The power dissipated by a transistor can be linked to a thermal model of its package and heatsink, for example. In particular, any single connection (node) can represent any pair of variables used to link a system: voltage and current are intended, but you might construct a hydraulic equivalent model with pressure and velocity, etc.

That's basically the overview of what to use it on. As for your particular question -- well, I hope you weren't simply expecting a "yes", because of course SPICE models are made from measurements. As for how, you've given no hint about what you want to do, so I can't offer any particular tips there.

Legally, yes, a model bears no relation to the device it's supposed to represent, and retains whatever copyright its owner asserts. You can decap, micrograph and model an IC, transistor by transistor, if you like; such reverse engineering (RE) is protected by law. What's not protected is exfiltrating proprietary information from the source; which is where RE can run into problems, and why corporations have to set things up very carefully (isolating the people doing the work, from any information the company might have that could "taint" their process; a "clean room" approach).

The most dangerous thing I suppose, would be the models the manufacturer uses internally -- which will contain proprietary process information (very precise models of devices a particular fab can produce), as well as trade secrets (the exact circuit being manufactured). You aren't likely to stumble upon such a model, at least not without layer(s) of encryption (such models are indeed commonly available, especially since LTSpice added crypto), or multiple layers of NDAs and perhaps service contracts in place.

Tim