Potential security problem: wallettpassphrase opens up the wallet for everybody! I am dabbling with Bitcoin-QT with -server parameter locally, I guess this is not very different from using bitcoind remotely. I use Java and some http client library pluss a json parser to communicate with Bitcoin API via JSON RPC. However, this question is not related to the platform I use in any way, this is a pure Bitcoin API question. 

What I have noticed is the following: if I make a call to wallettpassphrase with timeout, say, 5 seconds, the wallet remains open for all other connections for the same amount of time. For example, if connection A issues wallettpassphrase my_phrase 5, another connection, say B, does not have to know passphrase to spend coins. It is sufficient to try many times until some other connection opens up the wallet.

I haven't tried it myself, but I wonder... is this the same with bitcoind? In other word, if 2 different machines, A and B, connect to the same bitcoind server residing on a third machine, say C, and if machine A issues walletpassphrase for 5 seconds, will machine B be able to spend coins without knowing the passphrase within those 5 seconds?

If it will, isn't this a most serious impendiment for using bitcoind with many connections?
Yes, any person you give your rpcpass and rpcuser to can control your wallet, that's not what the wallet encryption password designed to protect against. You really don't want to be giving arbitrary users your RPC authentication details under any circumstance, and I can't think of one where you would need to.