Bitcoin core wallet's security When running a bitcoin node on an enterprise level: a lot of addresses will be generated with getaddress RPC for users to send their funds to. As far as I understand, these addresses, as well as the private keys for them, are all stored somewhere in the datadir. The whole key tree, as well as the seed key, can be dumped through rpc. Are there any rules of thumb to secure these keys from being dumped by unauthorized people? Are there any scalability problems with having too many keys stored in bitcoin core? Any other rules according to private keys and business set up?
All addresses and their corresponding private and public keys are stored in the wallet.dat file in the data directory. Assuming your Bitcoin Core is running on a machine which has access to many people but you want to prevent unauthorized persons from dumping the wallet on that shared machine, the best way I can think of is that you can encrypt your wallet with a passphrase. When they run the dumpwallet command, the private keys that are dumped will be encrypted.

When you want to get the unencrypted private keys you can run the command walletpassphrase &lt;passphrase&gt; &lt;time to unlock in seconds&gt; and then run the dumpwallet command.

However, using an online connected wallet for storing large number of bitcoins is not recommended as there always will be a weak point which can be exploited. You could run two Bitcoin core, one online and other offline. With the current Bitcoin Core, you create a wallet on your offline machine. Using it, you get one or more addresses (saving them, for example, to a text file). You copy those addresses to your online computer and give them to people to pay you. When you want to spend those payments, you create the transaction on the online computer in an unsigned form, copy it to your offline computer, verify it, sign it, copy the signed transaction back to the online computer, and send it. You can use the watch only functionality in the online Bitcoin Core wallet by importing the addresses using importaddress command.

EDIT for Bitcoin Core v0.18. The latest release of Bitcoin Core v0.18 supports hardware wallet integration to allow command line management of several hardware wallets including Trezor Model T, Trezor One, Ledger Nano, Digital BitBox, KeepKey and ColdCard. This would allow you to get the same security of a hardware cold wallet but with added functionality of relying on your full node rather than the SPV node of the wallet. For more information refer Using Bitcoin Core with Hardware Wallets on GitHub.