Best practices for securing a Buddypress installation?

Kit, I’d say that if you make extensive use of Exec-PHP what you really need is a developer that can make stuff happen without it. In reality, that plugin is a crutch that is easily replaced with proper widgets, plugins and template code. So, the best advice I can give you about securing that plugin is to remove it.