>> Could it have a cron that runs as a user with write access to perform upgrades, while publicly-accessible processes don't? > In theory yes. In practice no.

>> Could it have a cron that runs as a user with write access to perform upgrades, while publicly-accessible processes don't? > In theory yes. In practice no. FWIW, after my one and only Wordpress installation was cracked via a vulnerability identical to the one reported in this thread (back in 2010-ish), i did exactly that: made all of the files and dirs read-only to the web user, and made the read/write only during upgrades. Since ditching that site, though, a couple of years later, WP has remained on my blacklist and i've neither touched it nor recommended its use (and actively recommend against it for anyone who asks because of its long, glorious history of being cracked). To this day, WP is still the only server-side software i've ever run which was cracked from the outside.