You misunderstood build. It’s just an alias of new, nothing special. https://github.com/rails/rails/blob/959fb8ea651fa6638aaa7caced20d921ca2ea5c1/activerecord/lib/active_record/relation.rb#L84
build won’t “create” a record in database, just create a new object in memory so that the view can take this object and display something, especially for a form.
For your second question, yes, your way of composing by id will work as well. But a better approach is not to trust param. Instead, verify it by finding in db at first.