I turned on sandboxed solutions and after doing some other things, it worked. However, I also deleted all the custom code, so I may not have had to turn on sandboxed solutions.
My question was whether to turn it on or not. After some amount of research, I found that most everyone has it turned on, and it allows certain code to run in a different thread so that if it crashes it doesn't bring down the whole place. If you don't have it enabled, you cannot run custom code in your infopath form. The reason for the sandboxing requirement is because the infopath form runs in the browser, and Sharepoint doesn't want any malicious code (which could have been inserted by anybody who can publish infopath forms to your Sharepoint) to affect the actual server.
So, the short answer is YES, you do need to have sandboxing turned on if you are going to use custom code.
So, in order to update the content type, you just re-publish it. If you have everything in place, it will replace the former form, and anywhere the content-type has been deployed, it will be updated. Thus you will have achieved to update multiple instances of the form with only one edit.
However, if you have code-behind in your form, you have to jump through some other hoops.