Is a partially restricted admin user a threat to the WP security?

Hello, I have more of a general question here, which google didn’t answer.

I’m creating a ticket selling platform on which on one side the organizers have the possibility to register and have a (manually created) WP admin account through which they can create events and tickets.
On the other side people can buy the tickets through Woo and the organizers can check them through an QR app.

So there a lot at stake here, thousands of attendee and event data, organizers private data like invoices etc – this should never get lost, not even stop working for more than a few minutes, like the site should be ROCK solid.
So I started considering WPMU as a good starting point, because you offer the basic security, and the snapshots plugin is exactly what I was after. Then I would like to find one dedicated guy to take care of the rest of the security, cause I myself know nothing about it.
A friend who worked at a antivirus company told me it might me certainly safer to use WP than to code the platform myself – is he right about that?

But now my main question is how much should I worry about the security of the admin? If the organizer users have a partially restricted access to the admin (they will be able to edit only their own content and they will have access only to the event and ticket posts and own profile settings) and a hacker would get hold of this account, is he able to get in the other parts of the WP admin / is he able to harm the WP with this kind of access?

I am considering another option – to use multisite – one site for the admin area, the other for the front end shop – and maybe use Broadcast to copy the content from one side to the other. Or I could even use one site per each admin user. I thought it might give the site an extra layer of security, but maybe I am absolutely wrong, maybe the opposite.

Fun fact – the owner of the biggest ticket selling company here is the prime minister, a very well known villain, and these people don’t like competition and they don’t mess around, so I should be prepared for anything :slight_smile:

I would be very glad if you could answer me these questions. I am still looking for the security guy and I would like to start working in the meantime, so if WPMU is a good option, I would start with that. Not sure about the multisite option though.

Thank you!