To 1:
Yes a user may call the function even if they don't have access to the php.ini. You may use safe_mode(DEPRECATED and REMOVED in 5.4) or the disabled_functions
ini directive to avoid this. However, set_time_limit
is potentional misleading (read below). If you don't want to change the php.ini it might in a web context be possible to set the max response-time at the server level or the used cgi config.
To 2 also answers 3:
Disallow the function and/or set max_execution_time
.
Note: set_time_limit
counts the execution time of the current running php script, not the time the script spends waiting on external ressources (Exception ofcourse on windows).