Question: Over the years various versions of .NET have been deployed to my client machines via WSUS. Now it seems that on many machines these installations have hosed eachother, and certain .NET security updates are failing.

I verified that I can run the .NET cleanup tool to get rid of all the .NET installations on a client, and I can then push out .NET 3.5 via WSUS. This seems to have solved the problems I'm having on the machine I tried it on.

So the question is: if I've got .NET 3.5, is there any reason to also have previous versions installed?

Answer: 
Backwards compatible is a bad term to use. .NET 1.0, 1.1, and 2.0 are their own frameworks that have no compatibility between each other. .NET 3.0 and 3.5 are super sets of the 2.0 framework, using the .NET 2.0 base framework, with additional dll's to provide additional features (3.0 included things like WCF and WWF, 3.5 had things like LINQ). In terms of application requirements:

* 1.0 apps requires .NET 1.0 to be installed.
* 1.1 apps requires .NET 1.1 to be installed.
* 2.0 apps requires .NET 2.0, 3.0, or 3.5 to be installed.
* 3.0 apps requires .NET 3.0 or 3.5 to be installed.
* 3.5 apps requires .NET 3.5 to be installed.

I'm fairly certain that .NET 4.0 follows the same model as 2.0 - 3.5 (2.0 base with additional feature dlls). So installing .NET 3.5 will cover you for .NET 2.0 - 3.5 applications. You'll need to install .NET 1.1 if you run any 1.1 apps (same for 1.0 apps).
No, .net is not backward compatible. MS reserves the right to make changes. 2.0 u to 3.5 are IIRC, but that is more a "lucky side". The concet is th have al frameworks installed that are needed, and an application targets the framework it was compiled against - this allows MS to clean up new versions and introduce non-compatible changes.