1. Correct. Reader cannot remove security but Acrobat can (if they have the password).
2.(a): I wouldn't say "average but it can be done quite easily
(b.) Not really
(c.)No. Reader cannot remove security
3. Basically without using some sort of Digital Rights Management, nothing is secure. There are free applications that can remove security and other PDF readers may even ignore it to begin with.
So if you absolutely need security, studay up on Digital Rights Management and get out the checkbook because it isn't cheap by a long shot.
It doesn't take much specialized knowledge to search on Google to find applications that can remove password protection from a pdf file.