What are the possible exploits if settings.php is writable?
Option 2 is marginally better, but if you get p0wned, a hack script will chmod the file before it tries to append to it, which pretty much renders permission-based protection useless.

Personally, I would make up shell scripts to take care of the permissions for you.
For deployment, something like

find docroot/ private/ -type d -exec chmod 555 {} \;
find docroot/ private/ -type f -exec chmod 444 {} \;
find sites/default/files/ -type d -exec chmod 755 {} \;
find sites/default/files/ -type f -exec chmod 644 {} \;


Then, when you want to run drush or make updates

find docroot/ private/ -type d -exec chmod 755 {} \;
find docroot/ private/ -type f -exec chmod 644 {} \;


You should also read through Securing file permissions and ownership.  This article includes a different version of shell script for fixing permissions, and uses a slightly more restrictive scheme.