Most of the cases. But not only the developer sometimes the owner take advantage of developers works.
Most of the private server modified their setup from /conf/battle such as custom drop rates / exp rates / other modification.
Item implementation and also custom NPC's.
If there's some scam reports, hacking incidents and other things Yes.
Or if you are watching your GM activities too.
You can hire a developer depends on what you need. If you know how to setup the server then you don't need to give them an access.
a.) Your developer will only send you the script/src/files you asked. And you are the one who will install it to the server.
b.) If you hire a developer and you have 0% knowledge then there's a chance that your question #1 will happen.
Yes, they do have access. Just a tip. Do not host your server to any RO-hosting, pick something like popular one. Digitalhosting, OVH, Usdedicated or NFOserver
This is very tricky. If your server is doing fine without getting DDoS you can just host it 4-8gb Ram server and cheap hosting but good speed such as nfoserver and digitalhosting.
Server host: around 20-200$ again depends on what your server need.
Website host/forum: 5~20$ this is pretty much the same. You can buy a monthly web hosting or yearly (for cheaper price).
Gameguard: Gepard shield. 150$ for basic Gepard Shield. functor also offers some addons such as aura/color nick and lgp.
Developer: depends on the agreement.
Advertisements: Depends on how big the server you want to be.