1) chmod /var/www/whatever and all subdirectories such that the web server user can read but not write to them. If you need to do uploads or add a plugin, you can do it over SSH. Allowing someone to execute arbitrary code from your website is just asking for pain.
2) Many (but not all!) exploits start in wp-admin. I make mine inaccessible over the public Internet, enforced ny Nginx before any PHP gets the chance to execute. (Options: only accessible over VPN, only accessible through proxy you control, only accessible with a client certificate, etc.)
3) Routine DB/code backups. I'd keep wp-content in a git repo. Add a plugin? Have to add it through repo. Code changes other than through git? Smack yourself for setting permissions wrong, then roll back to a known good version from the repo. Weird links on blog pages? Roll back DB to known good version.
4) Should go without saying, but every blog gets it's own user and own DB, and that user only gets sufficient privileges to manipulate the blog DB.
5) Write a shell script to do an automatic "upgrade all blogs to latest version of WP" since you'll be doing this a lot. If this were totally risk-free I'd put it on an hourly cron job.