I understand, except I don't know what a oper may do to deserve to have their nick suspended and not have their oper access suspended as well. Your module though and I'm just grateful that it exists at all
Additionally you wouldn't have to worry about xxx[away] because when a registered nick changes their nick, their na->status changes and is treated as an unidentified user until they ID to the new nick, which your module already accounts for. Anope already knows if xxx[away] is in the same group or not. If it is, then you return MOD_CONT, if it's not then you de-oper them.
I was also going at #2 to be more internal oper list driven than the nick/group based list. The module could optionally de-oper anyone that isn't on your modules allow list, id'd or not. THAT list can have a un/suspend feature that regulates who can oper and should be detectable via Anope's nick groups.