Is it possible to serve a theme from outside the web root? We have a need to keep a proprietary theme in a directory that isn't readable or writable by a client. 

At the same time, the client needs to be able to do standard Drupal updates (ie, they will have full control of the web root of the Drupal installation, but nothing above that).

What's the easiest/best way to accomplish this, assuming it's possible?
If you have

Options +FollowSymLinks


set for the DocumentRoot for your Drupal site, you can put the proprietary theme anywhere you want as long as you create a symlink to it somewhere Drupal searches for themes (eg, sites/all/themes).

Just keep in mind that Apache needs to be able to read it.  Whether the client can read it directly is a permission issue, but if Apache can read it a savy client can get it via custom PHP.