You can yes but if you are using relations there will be a bit of manual migration required to remap the relational IDs.
Heroku + Mongo Atlas inherently is insecure as you need to open your atlas security settings to the public web 0.0.0.0/0 as Heroku doesn’t provide a list of possible IP addresses their connections could come from, and that IP changes every time the dyno restarts. They offer an in-house PG add-on that lives inside their network, so less risk of a data leak.
Depends on what you are referring to, if you have a link to your project I could take a look.