How reliable is a daisy-chained USB bus? What are the risks and how can they be minimised?
You are correct in that surges are a concern for cascade failures; it is also true that USB is not galvanically isolated by default, and in fact is a pain in the rump to isolate due to its half-duplex, bidirectional, differential-but-not-always (blast the SE0!) nature.  Thankfully, the good folks at Analog Devices stepped up and put together the ADuM4160 to take care of all of the truly hard parts of USB isolation -- while it only supports low or full speed operation, and cannot pass low/full speed negotiation signals, meaning it can't be built into a general purpose isolated USB "lump" without help, it is still the closest thing to a generic USB isolator available.

Assuming that a reliable 5V supply to the hubs is available, and preferably one 5V supply per hub (not hard!), I would split the hubs into 4 ports each and isolate the upstream port for each hub -- pick your favorite hub chipset here.  Along with good per-port surge suppression, for which I'd specify a pair of Bourns TBU devices in series with D+/D- and a shunt low-capacitance, high-energy suppressor in addition to a MOV and TVSS clamp + current limiter or PPTC for Vbus and the obligatory TVSS/clamp network for D+/D-, this should limit the propagation of surges through the USB network.