The security story for Drupal is quite good from the government perspective. It is used by many serious organizations, so there are a lot people to find bugs and problems. The Drupal community have a formalized standing security committee who cover the core code and the most commonly used modules. They issue security patches on a predictable, regular schedule. And many of the core developers are employed by one company--Acquia--who sells enterprise software support subscriptions.
That checks a lot of boxes for enterprises in general, and governments in particular.
Plus it is a very powerful framework but is way cheaper than "traditional" license-based enterprise solutions like Oracle CMS. And it's open source, which is citizen-friendly and gives governments better long-term ownership of their technology.
Finally, although Drupal developers are their own sort of special flower (hopefully changing with Drupal 8), there are a lot of them and a lot of companies that provide Drupal development. So if you have to fire a vendor, you'll be able to find another one to step in without too much fuss.