What privileges should a MySQL user have?
For development you'll need essentially everything - including drop. Once you go live, drop is generally not needed.

That said, if you're allowing delete - for instance - then drop isn't much more drastic. If someone owns your server, deleting all the rows from your tables is pretty much as bad as dropping a table - either way, the only good fallback is proper backups.

Setup your database user to only be allowed to connect from the host Drupal is running on. And make sure if that host has ssh allowed, you're using keys, and not just username/password, and you should be pretty good.