Security properties of an encryption scheme built from a PRP and a PRG
Fourth, I think $E(k,m)$ is CCA-Secure too, right?


Consider this: what if an attacker takes a valid ciphertext $E(k,m) = ( P(k,r) , G(r) \oplus m )$ and flips a bit, so that it is $P(k, r), G(r) \oplus m \oplus 1$.  What would happen if you gave this altered ciphertext to the decryptor?