1. Someone thought chmod 777 was a good idea, ever, under any circumstances. Not only is this standard practice in Magento installs (it's a how-to step in many books on Magento), it's all through the actual codebase.
The below is from the Magento Enterprise 1.14.0.1 tarball, downloaded from the company (and I double-checked this after someone questioned this last time I brought this up):
$ grep -r chmod .|grep 777
./downloader/lib/Mage/Backup/Filesystem.php: chmod($backupsDir, 0777);
./app/code/core/Mage/Compiler/Model/Process.php: @chmod($dir, 0777);
./app/code/core/Mage/Install/Model/Installer/Console.php: @chmod('var/cache', 0777);
./app/code/core/Mage/Install/Model/Installer/Console.php: @chmod('var/session', 0777);
./app/code/core/Mage/Install/Model/Installer/Config.php: chmod($this->_localConfigFile, 0777);
./app/code/core/Mage/Catalog/Model/Product/Attribute/Backend/Media.php: $ioAdapter->chmod($this->_getConfig()->getTmpMediaPath($fileName), 0777);
./app/Mage.php: chmod($logDir, 0777);
./app/Mage.php: chmod($logFile, 0777);
./lib/Zend/Service/WindowsAzure/CommandLine/PackageScaffolder/PackageScaffolderAbstract.php: @chmod($path, '0777');
./lib/Zend/Service/WindowsAzure/CommandLine/PackageScaffolder/PackageScaffolderAbstract.php: @chmod($path, 0777);
./lib/Zend/Service/WindowsAzure/CommandLine/PackageScaffolder/PackageScaffolderAbstract.php: @chmod($path, 0777);
./lib/Zend/Cloud/StorageService/Adapter/FileSystem.php: chmod($path, 0777);
./lib/Varien/Autoload.php: @chmod($this->_collectPath, 0777);
./lib/Varien/File/Uploader.php: chmod($destinationFile, 0777);
./lib/Mage/Backup/Filesystem.php: chmod($backupsDir, 0777);
./errors/processor.php: @chmod($this->_reportFile, 0777);
The way we eventually dealt with hosting Magento (which we had strongly advised against) was a concrete sarcophagus and a thirty-kilometre exclusion zone:
* a cron line specifically to remove o-w permissions from all files in the webroot every minute (which is very inelegant, but the alternative is maintaining our own patches to core).
* Files not owned www-data, except where Magento must be able to write to them.
* deploy all webroot files as a user the webserver can't write.
* cron.sh (Magento's internal cron) runs as root out of the box. We ran it as www-data.
* AppArmor to keep Magento from ever, ever being able to pull shit. This caught Magento's more antisocial tendencies on more than one occasion.
* Admin login: use a path other than "/admin" to foil quite a lot of attack bots at the very simplest level.
We have outsourced our remaining Magento, thankfully, and I don't personally have to maintain the above any more. (You know you've been administering Magento a bit long when you can hum along to bits of "Metal Machine Music" accurately.)
The use case for Magento is (apparently deliberately) confused. It's an unholy melange of a CMS and a shopping basket. There is no good out-of-the-box experience; in practice it's a job creation scheme for consultants.
Even crap-tier "well technically I can tell my boss's boss we have paid support" support, with a four-day response time for them to ask you a simple question you already put the answer to in the original ticket, is swingeingly expensive. I can't say what we're paying for this standard of quality, but I can say that it's public knowledge that Magento is at least $13k/yr: http://web.archive.org/web/20120215011525/http://www.magento...
The problem Magento seems to solve is when the business wants a quick site without developer involvement. After a few other abortive platforms (Plone, Drupal - which are both fine for what they are, in ways Magento just isn't, but didn't end up matching our needs), our eventual solution to this was Wordpress, which we have outsourced so I don't have to think about that either. Outsourced Wordpress with securing it being the host's problem is totally the right answer.
I don't have a good answer on the shopping basket, but Magento was bad enough at that too that we went back to our in-house homerolled system.
I understand some work has gone into Magento 2.0 to make it less mind-bogglingly horrible.