so with two patreon style sites both of which say "we take security seriously" , until they have a breach, how would you judge which one would take better care of your data?

The information (AFAIK) about their security mechanisms only got released as a result of the breach, so even assuming you knew what the terms were and how to judge good security from bad, you wouldn't have the information until the site got compromised.

This is a very common problem, some more examples here http://raesene.github.io/blog/2014/06/08/finding-security/