The best way for the wizard to defend a spellbook is the same as the best way for you to protect your precious computer files - have multiple backups.
But, if he hasn't had time to make a copy, if he knows someone is trying to steal the book back, he wouldn't leave the book in the shop overnight. He'd keep it on himself, likely guarded by as many guards as a 7th level wizard can afford to hire on a temporary basis.
If he must leave the book in the shop for plot points, he'd certainly have the book very well protected and secured. He's 7th level, so he knows 4th level spells. He might, for example, use Stone Shape to fabricate a 'doorless' safe in a wall or floor block. And he'd certainly know to keep the book in a lead box to block scrying and detection attempts. He could also use illusions to hide/conceal the book. And decoy books and safes to waste the thieves' time. And of course, a 1st level Alarm spell on the shop would work wonders. He might hire a dozen men at arms who hang out in a neighboring building waiting for the alarm to go off.
You say he can't use anything too damaging in terms of traps. Well, poison gas doesn't cause much physical damage and dissipates after a while. And while you say its illegal for him to create fatal traps, a) he may not care, b) bribes and Charm Person can get the well-to-do out of trouble, and c) dead thieves can't report you to the town guard. If you don't want to do that, you can always fill the shop with a Web.
Beyond defending his shop, since he knows there's likely going to be a break-in, he might have a familiar watch the shop from a distance and follow the thieves back to their home/inn/hideout. And when they aren't looking, he can rob them blind.
Not specified, so the DM chooses it.
Well, it is a variant rule so it is up to the DM from the beginning. There are no references in XGtE or VGM about it, at least not one that I remember from when I read them or one I could find in a quick search. From the principle of there are no hidden rules, we can assume that if the spell list was intended to be limited to some class, it would say so, just as it does for Mindflayers (which have Wizard spells), Driders (which have Cleric spells) and others.
Volo does talk about Kobolds, which are draconic creatures linked to dragons, and their spellcasters are Sorcerers (p. 64), if that helps you at anything.
My personal guidance on how I ran dragons in the past is simply choose the one that makes more sense for your dragon, as you described in your fourth bullet.
Remembering the spellcasting divisions is something that may help you in deciding which makes more sense.
- Arcane or Divine? The Spellcasting chapter describes how magic works through affecting The Weave. There are two types of magic: Arcane or Divine1.
- Spontaneous or Prepared? Spontaneous spellcasters simply know spells, such as Sorcerers, Bards and Warlocks, while prepared spellcasters have access to many (usually all, except for Wizards) spells, but can only prepare (through Praying, Studying or something else) a limited number, such as Clerics, Druids and Wizards.
So, which ones do your dragons fit better?
In particular, Sorcerers are probably the closest to Dragons
While there are a few spontaneous casters (Sorcerer, Warlock, Bard), the ones described as being born with that magic running through their veins are the Sorcerers (under Unexplained Powers, for example):
People with magical power seething in their veins soon discover that the power doesn’t like to stay quiet.
Additionally, sorcerers have the Draconic Bloodline origin, putting them again as the one closest to dragons - one of their possible magical sources is the same as dragons.
Finally, note how the text describes the dragon spellcasting.
Dragons are innately magical creatures that can master a few
spells as they age, using this variant.
A young or older dragon can innately cast a number of
spells equal to its Charisma modifier. Each spell can be cast
once per day, requiring no material components, and the
spell's level can be no higher than one-third the dragon's
challenge rating (rounded down). The dragon's bonus to
hit with spell attacks is equal to its proficiency bonus+ its
Charisma bonus. The dragon's spell save DC equals 8 +its
proficiency bonus + its Charisma modifier.
From this text, the resemblance to Sorcerer is quite huge: They use the same Charisma modifier (opposed to Wisdom or Intelligence) and it's likely their spellcasting uses their own understanding of the Weave, not intervention of some god like Tiamat or Bahamut. For that reason, I usually use as default that dragons are sorcerer-like spellcasters, and a few dragons are exceptions to that, e.g. a dragon that spent its life studying magic fits better as a Wizard, as you said, and I would change its spellcasting ability to Intelligence as well. This is completely on the realm of house-ruling or even homebrewing already, though.
1 - PHB, p. 206:
The spells of wizards, warlocks, sorcerers, and bards are commonly called arcane magic. These spells rely on an understanding— learned or intuitive—of the workings of the Weave. The caster plucks directly at the strands of the Weave to create the desired effect. Eldritch knights and arcane tricksters also use arcane magic. The spells of clerics, druids, paladins, and rangers are called divine magic. These spellcasters’ access to the Weave is mediated by divine power— gods, the divine forces of nature, or the sacred weight of a paladin’s oath.
This Warlock knows how to cast Magic Jar
That's it. That's all it takes. This guy can just do that.
In 5e, NPCs don't need to follow Player Class restrictions or guidelines. Dragons don't have Sorcerer levels, but can do magic. The Master Thief doesn't have Rogue levels but gets Sneak Attack and Uncanny Dodge. Lich gets 18th-level Wizard Spellcasting but doesn't need a spellbook or arcane focus and has a +7 proficiency (not even level 20 wizards get that).
The rules for players simply do not apply to NPCs.