1) bp widgets are available to all blogs. There isn’t a way in bp to restrict blog admins from using whatever widget is available to them.
2) The plugins that are located in /mu-plugins run on all blogs and don’t need activation by the site or blog admins. Plugins located in /plugins need to be activated on a blog by blog basis.
3) The avatars are located in /wp-content/blogs.dir/1/files/1/avatars/1 and should not be set to 777 but 755 and the apache user for your server must have write permission in that directory.
*Nothing* that you have control over should have 777 settings on your server. It’s a security hole.
Stupid people are the ones who don’t ask questions and live in ignorance.