there is repositoryHelper bean, with org.alfresco.repo.model.Repository class, used in several places, including patches. Repository .getRootHome() is used as a starting point for the search, for example ActivitiesTemplatesUpdatePatch.getBaseTemplate()
Problem is, that getRootHome() is not tenancy-safe, it lazily stores rootRef. BTW, getCompanyHome() just nearby doesnt use getRootHome(), so it is tenancy safe.
I dont understand, how it is supposed to work - was multitenancy ever tested in 4.0.d?