We must also approach this from a usability angle. If Robert’s webmaster is able to provide his own hardware server equipment, then you can do this. The stuff with creating VM’s is just not workable for Robert alone.
My 2 cents to find the middle road between wordpress hosting and self hosting is to find a good trustable all round hosting company that allows a high degree of technical freedom and provides automated backup systems and backup downloads.
This means, for a few dollar a month that you can put anything you want on the hosting space you purchase. Wherether this is a standalone wordpress, joomla, wiki or some other platform.
Having adressed the hardware side, lets go to the software side. Judging from Robert’s discussion points, the main requirements are access control, multi user environment and overall security and trustworthiness. To accomodate this, you are ending up at mature open source content management software platforms. And even in this broad category, only few are up to the task of this grand scale.
So that means keeping up with security issues in a short timeframe and being able to implement detailed and complex ACL shemes. These options seem viable alternatives: cmsmadesimple, Thunder, subrion and Joomla
Personally i have lots of experience with Joomla. This is a very mature system, very powerfull and very extendible. Thunder is a modified version of Drupal and the other 2 seem well equipped on their feature page.