Hi arkhas,
apologies in advance if this post should be regurgitating trivialties, but since many people don’t understand asymmetric mutual exclusion well, here is a short rundown of a few facts that may address some of your issues. In short, there rarely is a point in ISRs using critical sections - in the case of semaphore counts, for example, you would only need that if your ISR (while obtaining the semaphore count) gets interrupted by a higher priority ISR that signals the semaphore (thus changing the count) your lower priority ISR wishes to examine. I’ve yet to see (after 30 years of embedded development) a case of ISRs interacting like this. Normally synchronisation takes place between ISRs and tasks waiting for that particular device driver with no side effects to other components, as I’m sure you know.
Returning to your question, though: I believe you are basically right; most function pairs available in -FromISR and without it roughly go through the same code path, but using portSetInterruptMaskFromISR() vs. portEnterCritical(). For many MCUs (or ports, respectively), those translate to the same code, namely masking all ISRs up to configMAX_SYSCALL_INTERRUPT_PRIORITY or unmasking all.
A brief check reveales, however, that those API pairs don’t always end up in the same “worker code,” so it’s not only the bread that changes but also the meat. I’m sure there are very good reasons in every instance.