Can a server not configured for multiple tennants present opportunities for badly behaving tennants to compromise the other sites? Yes, this is a concern and there are various ways to address the session issue.
The first is to set the open_base_dir (and session.save_path) to restrict each running PHP instance to a directory tree - similar to a chroot environment (note that this does not restrict other programs invoked by system() shell() etc). This is the most efficient (in terms of capacity/performance) but difficult to configure correctly.
Another solution is to make sure the umask is correctly configured, use php_fpm and run separate pools with separate uids for each site. But this does not make for effective use of the process pool.
Another solution is to encrypt the session data. If you use the suhosin encryption method, then you should use a separate key for each site - you need to be careful about where you put the keys and the permissions associated with that file. Alternatively you could encrypt the session with a key persisted in a client cookie and never committed to storage on the server. Encryption won't stop a bad tenant from corrupting other peoples data, but they won't be able to read it.
....and that's before you consider the possibilities of multiple php-fpm instances (or apache+mod_php) running in seperate chroot environments or seperate containers, or vms.....