Can I remove write protection for all Drupal files?
Yes, although it will disable the installation of modules through the web interface (it writes in sites/all/modules), but I would consider that a feature.

You also probably want to use 0644 for files (rw/r/r), and 0755 for directories (rwx/rx/rx). By convention, you don't want files to be executable unless they are really meant to be.

Here is the official Drupal documentation on the issue:
https://www.drupal.org/node/244924

And this answer also has good advice:
What is the suitable file permission for &#39;files&#39;?