I don't really use multi-site, so my answers here are hypothetical. I recommend using a separate Drupal root for each site, unless you have a very strong reason to share code.
drush @sites sql-dump
is not a good idea. This is going to run sql-dump in turn on each of the databases of each of the sites. If this worked correctly, you would either get all of the databases concatenated together (e.g. if you sent the dumps to stdout, and saved the result via output redirection), which you could never hope to restore, or, each database would be saved into the same result file, each overwriting the previous. Drush does not support dumping multiple databases to a single dump file.
drush @sites pm-update
will do redundant work. It will run the code update on each site sequentially; the projects for each site are shared, so sites that are updated after the first will have most or all of their projects already updated. After updating the code, pm-update runs updatedb on each site, which does need to be done for each site's database individually. Note, however, that the most important part of an update is testing, so you might as well update each site individually.
If you want to update only Drupal core, use drush pm-update drupal
. To update everything except core, use drush pm-update --no-core
.