1) You can effectivelly share CB users between different websites but when you share an extension, this share all the records and also all the fields.
So if you share the CB users, you will have the same options in each websites.
The fact that you share the users between different DB does not change the fact that the users are store in a unique DB. The other DB using "links" to access the physical data (tables).
2) NO.
The concept of JMS is effectivelly to share the same Joomla installation PHP code and therefore if you have a hacker to modify the PHP code, as it is shared by all the websites, all the websites might be affected.
In our recommendation that are described in the technical document page 20 to 24, we suggest to put the master in a secure place that is not public or available from internet and just create slave sites that are the public one and that use symbolic link to access the joomla files and folders.
See
www.jms2win.com/en/tutorial#jms12x-0b
In a such way, it is technically possible (event if this is not easy) to make the symbolic link on autorized to read and execute files but not changing them and just let the master the read/write access as this is the owner of the files and folders.
If you really want to copy the files and folders, this is technically possible in JMS template rule but in this case, you will not benefit of the maintenance of the website as you will have to maintain several "standalone" website and synchronize them yourself.
3)NO.
As the concept is to share the files and folder of the Joomla installation, it is assumed that all the websites are runing on the same server with the same owner.
4) All depends what you mean by high number of similar sites.
If you number is > 1,000 websites a dedicated server is probably recommended.
Use a linux server with cPanel and WHM that generally are correctly configured by the hosting company.
Avoid using Plesk or Direct admin as administration tool with which you may encouter difficulties to setup the files and folders permission correctly. We estimate the administration workload at a ratio of 3 compared to cPanel. (3 times slower to administrate than cPanel).
Uses a PHP 5.3 or higher and MySQL 5.x.
In JMS, there are specific setting that we recommend to enable when it is expected to have more than 1,000 websites.
In example 10,000 or more websites. When the number of websites is > 1,000 we also recommend to use very basic rule that can be easily detected based on a URL present and with the objective to implement specific code to speed-up the "super switch" processing