I'm confused as to whether an FCM token is specific to a device, or a specific app on a device. In much of the documentation I've read on the subject, it says that an FCM token is used to "target a specific device", but does this mean that when that token is used, every app on the device can receive the notification? Or just the app that requested the token in the first place?
It's a token for app (uniq from firebase configs) and device. For example if you create 2 app with two different firebase configs but you request the token from the same device, the service will give you two different tokens.
To be clear: when Firebase documentation uses the term "device", it frequently means "app instance [on a device]". Therefore, the following documentation:
Register devices to receive messages from FCM. An instance of a client app registers to receive messages, obtaining a registration token that uniquely identifies the app instance.
... would more accurately be stated:
Register app instances to receive messages from FCM. An instance of a client app registers to receive messages, obtaining a registration token that uniquely identifies the app instance.
This also applies to much other mobile notifications documentation, including Microsoft's Notification Hubs documentation.