Yes, CAN0TARQ=0x07 is enough to abort scheduled messages. Of course it won't clear software Tx FIFO message queue your application may have.
I think behaviour on busoff is application specific. I ask myself what will happen if busoff takes a minute, an hour, more and then recovers? Of course all scheduled messages will be transferred. Can this be harmful? It depends:
1) slave scheduled answer to some query like "what is measured voltage" . Probably it won't break anything if master will get query answered even after long delay. Wrong or not depends on how fast queried parameter may change, is scheduled answer still correct or not.
2) master scheduled command like "make that big saw running". It has to be aborted, isn't it?
3) some big file transfer from slave was in progress and for some reasons slave can't resend any part of file. It may be better to not about such message.
...
Robust high level protocol may fight above examples without requirement to abort any messages. Also application may have extra security measures. For example slave saw cantroller may require periodic confirmation from master that it is still OK to keep saw running.