1) You *could* create your database user with limited permissions (I don't know the maximum required off hand)... however, if someone gets hold of your SQL username and password (or otherwise finds a way to execute arbitrary SQL commands), I think it's safe to say you're pretty screwed even with those permissions. Amongst what you list is DELETE and DROP - that's everything that's needed to destroy a database.
That one sounds just like a way to make people feel more secure.
2) That won't prevent injection threats. I believe the thinking is if someone has found an injection vulnerability, it will limit the damage they can do, but, as I said before, if someone has found a way to execute arbitrary SQL commands - it's kind of beyond the point of help. All they need to do is run "SHOW TABLES;" and they'll see a list of your tables, thus showing your prefix.
3) Not totally sure what those keys are for...
4) Yes, a secure password is always good :)
5) All those are good ideas, and there are features in IPB for doing them.
6) The option is in 3.0, although, for many people, it's probably not worth the expense ;)
7) I agree with Wolfie, that just seems annoying to me: "Hey, you just signed in to the ACP!"