The XML sitemap part is more myth than fact. It's a placebo to make you feel like you're doing something.
If all the pages of your site are properly crosslinked so that when the spider walks the page it can find everything, there is ZERO legitimate reason to waste your time on a sitemap.
What you've outlined is pretty much the be-all end-all of legitimate on site SEO. The other half of SEO is promotion, where you have to tell people about it.
Backlinks to the site are the other major factor alongside your content quality. They're the yin and yang of SEO. The trick is that even if a page sets your links to nofollow, it still can bring traffic in. Pages that set Nofollow links aren't "evil" or "a waste of your time" as the people coming in may organically link to your articles. These "organic" links have long-term credibility.
There's a rather sleazy part of the web where something called "link farming" takes place. People often pay to get "follow" links spammed across dozens of sites. Such "link farms" though are known to most search engines, and once the engine notices that it's a farm, it gets blacklisted and so can your site. It's another of the "take the money and run" scams that works for JUST long enough to rob the bank, but not long enough that the site owner won't get caught holding the bag.
It's ok to flood links to places like forums and social media, in the hope that people will naturally share those links giving you "link mojo". It's a slow methodical process that's just part of promotion.
In that regard, don't underestimate social media's impact. Whilst sure, facebook and the like also are nofollow, these days for traffic they often rival or surpass search when it comes to visits.
Search is passive, your site only comes up when people are looking for you on purpose. Social media is active, like real advertising. It comes up on people's feeds just because. The links you can get from social media growth can often cross over into organic links when those you reach share it someplace else like their own blog.
It's just when people try to buy and sell backlinks that things tend to go bits-up face-down. That entire aspect of SEO is 100% scam and should be avoided at all costs.
Other than that, you've got the basics. Semantically marked up well written unique content of value being the king of it all. Without that every other SEO trick in the book is nothing more than dumping a can of shellac on a pile. You can let it dry, take a buffing wheel to it, making it eye-searingly shiny and reflective, but it's still just bug excrement on horse manure.
