Is there a best form for security surrounding updating an entity of an unspecified type?
I think the entity metadata wrapper is semi indiscriminate aslong as the field is the exactly the same on both entities. So you can just wrap it and then use the default set/get methods 

// All your code (it looks fine) 
$wrapper = entity_metadata_wrapper($entity_type, $entity);
$wrapper-&gt;FIELD_TO_SET-&gt;set(VALUE);
$wrapper-&gt;save(); 


More info on the metadata wrapper