Sovereign immunity varies widely from state to state. A university the size of PSU must get sued with some regularity, so it's not a question of having a good lawyer -- PSU's legal status is almost certainly a question with a settled answer. I just wasn't able to find that answer on Google in under five minutes.
No idea what kind of insurance policies PSU might have, or what the exclusions might be. Gross negligence is typically carved out of corporate D&O policies, because the law generally doesn't allow corporations to indemnify directors and officers for gross negligence. I don't think gross negligence applies here, though. It's possible (though not certain) that PSU has insurance that would cover intentional or reckless acts by its employees.
In any event, a plaintiff would have to prove causation*, and that's where I think PSU has better defenses than a lot of defendants in abuse cases.
*-This might not be true for claims arising before Sandusky's retirement. Statutes of limitations for claims involving torts against minors generally don't start to run until the victim reaches age 18, so it's conceivable that some of those claims are still viable, but they'll almost certainly represent a minority of the total potential claims.