Can I remove write protection for all Drupal files? Just to prevent hacks, can I remove write protection in all files and directories in my installation, except for in sites/default/files?

I mean I want to chmod to 555 and chown them all to root:root except for files within sites/default/files. For installation/uninstallation I use Drush.

I'm talking about the "Config 1: Web server is running as owner" as described as in What are the most appropriate users and permission levels for Drupal sites on shared hosting?

It seems  my four sites are working fine with this. Is it OK?

This is because to ward off hack attacks which place php files in within site folders.
This almost saved my site from this Highly Critical hack attack but the hacker was able to place php and execute file within sites/default/files as my .httacces was not protected from running php scripts within the files directory.
Yes, although it will disable the installation of modules through the web interface (it writes in sites/all/modules), but I would consider that a feature.

You also probably want to use 0644 for files (rw/r/r), and 0755 for directories (rwx/rx/rx). By convention, you don't want files to be executable unless they are really meant to be.

Here is the official Drupal documentation on the issue:
https://www.drupal.org/node/244924

And this answer also has good advice:
What is the suitable file permission for &#39;files&#39;?