> 2. Security concerns regarding automatic evaluation of expressions inside the strings.

How are there security concerns? Its a kind of string literal that is expanded into a calls to builtin formatting functions at compile time, so there is no more security concern with evaluating expressions in it then there is with evaluating expressions in the non-string parts of your code.

> Also, why was format and % made in such a way as to require an explicit list of variables? What was the reasoning behind it? Is that reason no longer relevant?

You can use those without an explicit list of variables, its optional to use explicit variables for clarity (though in many cases the natural naming will also make it redundant in simple cases.)