Most shared hosting packages store all files of a given user under something like
Addon domains are usually located under
Is there a way to (using .htaccess) prevent one addon domain from accessing the files of another domain and a potential malicious script (e.g. a rogue theme) from reading or executing or writing files to another addon domain's folder?
This way, if one site is compromised, the others will not be affected.
I realize this is not the only required step to harden the security of a WordPress installation but it's a good starting point to prevent a potential exploit from doing too much damage.