I'm not sure and can't find if they disable it by default, though if it's shared hosting they should and most likely have :)
Sure, Loopback connections are when the the site tries to make http connections to the same server as the site is on- 'looping-back' on itself. These are an easy way for a malicious user to take down a webserver
So it basically loops back on itself to upgrade each website on a multisite install, if that makes sense?