Maybe it's my mis-understanding, but ...
IF anyone (including an authenticated user in a Moodle who is not admin level in the moodle), can browse moodledata/filedir/ that's potential for a hacked site. Takes a lot of 'work', but that authenticated student user who doesn't particularly have to have 'hacking skills', could acquire the admin users credentials and login as the admin level user. Bad news!
For #2 ... one of the duties of a server admin (OS/Azure) would be to make site backups. If moodle A is where the shared moodledata directory resides and moodle B needs to be backed up, better include the 'shared moodledata/filedir/ in moodle A. If one had to restore from a site backup for moodle B and that instance had included the shared moodledata/filedir/ there is a chance that will mess up moodle A - depending upon usage of moodle A vs moodle B. That too is not good!
All in all ... me thinks it's best to have separate moodledata per site.
You can, of course, try it ... best of luck to ya! 
'SoS', Ken