Advice on latest drupal security advisory having followed most of the instructions do I rebuild the server?
You have a couple of questions here so I'll answer the one that I can. File permissions.

The short answer is it depends on your setup as to what the best permissions are.

It depends on your system's users and groups and what account runs the web server process.

There is a lot of more detailed information at Securing file permissions and ownership.

I will give one specific though:

Something to consider aside from the security of your website is the security of your server.

If all your files have to be edited by root does that possibly mean you are regularly using the root account or sudo to do things?
If so that is bad for server security. You shouldn't really need to be root to edit website files like that.

Instead of using root maybe use a non-root account with a strong password.

Remember, root is no stronger than any other user in terms of what password they are required to log in with, but has infinitely more power once they're in.