If you have access to inside the walls (sheetrock down), there's no reason not to flush mount them. Plastic or steel, it doesn't matter.
It depends, but generally, I don't think it's a violation unless the Romex is running unprotected in an area that can cause damage to it. Running it short lengths to a diswasher is not all that uncommon, but if I had a choice, I'd hard wire it via a juction box, flush mounted in the wall. Don't forget that the jbox has to always be accessible.I have seen some examples where the Romex just sticks out of the drywall and is spliced directly into the appliance (on a dishwasher, disposal, or vent hood). Is it to code to have the NM cable running unprotected like that outside of the wall?