[till]

so I can set custom php settings for the sub-domain, like I can for the domain itself?

Yes.

but that doesn't eliminate the risk to the whole server (like you mentioned).

That reduces the risk a lot because fastcgi runs a separate php process for each website under a separate linux system user while mod_php runs one php process inside apache which is used for all websites and which uses the same linux system user. So with fastcgi and suexec, you have separated php processes and also separate linux users so the full linux file system permission restrictions apply for each website.