Where cluster metadata is stored?

You are correct, master nodes are clueless about erased cluster state files, they will continue to start up with an empty memory, and bad things might happen.

AFAIK cluster state is not saved on nodes with node.master=false which is also a pitfall when taking down all master nodes while data nodes are up.

The picture in the blog post is not exact. The index state does not turn to green before a quorum of all data nodes with shards for the index is up. Before that, the state is yellow.

The rule is "do not index documents to a restarted cluster with replica shard count >0 when index state is yellow, wait for recovery of index until last node has joined". Otherwise, primary shards may flip to a shard on a node joined more recently and previously indexed documents might get lost.

See description of issues and mechanism of "allocation IDs" at https://www.elastic.co/guide/en/elasticsearch/resiliency/current/index.html