Yes, routing is correct. Routes specify access rules, if you want your route to only be accessible for a certain node type, implement custom access callback and check for that.

The local task will then automatically respect that

Yes, routing is correct. Routes specify access rules, if you want your route to only be accessible for a certain node type, implement custom access callback and check for that.

The local task will then automatically respect that.

Example from core:

comment.reply:
  path: '/comment/reply/{entity_type}/{entity}/{field_name}/{pid}'
  defaults:
    _controller: '\Drupal\comment\Controller\CommentController::getReplyForm'
    _title: 'Add new comment'
    pid: ~
  requirements:
    _custom_access: '\Drupal\comment\Controller\CommentController::replyFormAccess'

That method then can receive the same arguments as the controller/form, in your case the node (just add NodeInterface $node) and you can check the type there and everything else you want (like permissions)