Securing file permissions and ownership on a shared host that uses chroot jail

With most shared hosting you cannot create a user, and you cannot chown anything. In addition, on shared hosting the php is almost never executed by www-data. (cPanel normally uses Centos / RHEL, and you will often see the doc root has 'nobody' or 'http' or 'httpd' as the group, which is the process which owns Apache, whereas Ubuntu / Debian have Apache owned by www-data - just convention, makes no practical difference).

On shared hosting you are largely stuck with the security provided by the host, at server level. (Of course at site level, the security of your code and your update policy is in you own hands, and Wordpress security plugins, for example, can impose restrictions which make a WP site harder to hack). Between sites ('addon domains') on a single cPanel or similar account, there is really no security - which makes a Drupal site very vulnerable if it is shared with an insecure site. If you have a Wordpress site site on one of your domains be careful to keep it updated, and not to install suspect plugins. (I have been bitten this way.) Between separate shared hosting accounts on the same server, as distinct from separate sites on the same account, the webserver should not be able to write from one account to another, and generally you can trust this to work out of the box.

You can set permissions
Assuming doc root is public_html you can do:
chmod -R ugo-w public_html
chmod -R ugo+X public_html
cd public_html/sites/default
chmod -R ug+w files (assuming files is your files folder)
IMO that's about it, and probably adds nothing to the out of the box setup of the server. Between 'addon domains' the hacker could probably reverse those steps once he is in, so it does not seem to add much.

If you want shared hosting and you want more security than generic shared hosting, you probably need to pay the extra for managed hosting of the Pantheon type.