I worked full-time as a Drupal developer for two years and still dabble with it, though I'm now using Rails as my main web ui development technology. Though I'm not as connected to the community now, I've always been impressed with the level of participation that the community has, the outstanding volume of the work being done, and the commitment (for the most part) to the "Drupal Way".
I haven't heard of any major incidents of compromise, though it is easy to let sites get out of date which would leave some holes open.
As for MySQL, I think there are plenty of examples of it working at massive scale with good security (inside the Drupal community and out). From what I've seen developers seem pretty committed to working with other databases, though I'm not sure how far beyond MySQL and Postgres you'll get.
As for the "effective as an MVC question": no. Looking at that chart, half of the items mentioned in the Controller and Model you aren't supposed to edit regularly (parts of the Drupal Core), and especially not for site-specific functionality. Sure, most things can be altered with the addition of modules, but you're eventually going to run across something that can't be easily overridden from a module, or a place where there's no hook, or you just fundamentally disagree with how something works.
The modules themselves can be just as frustrating. Sometimes you'll encounter a situation where a module gets you 95% of the way there, but again you'll need to make some alterations and you have to understand exactly how the module works in order to do this. That means delving into someone else's code, the quality of which can vary considerably.
Finally, Drupal isn't REALLY object oriented. It's not as if content types are represented as a model with a corresponding controller, which is how I would expect MVC to work. A lot of individual pieces of code are OOP, but the entire system wasn't designed with this in mind.
That's not to say that Drupal doesn't have its uses. If you are fine with the default that's provided or feel like getting 95% of the way there in some cases is good enough, then by all means fire up a Drupal site. Unfortunately, you need to be familiar with the options out there in order to easily make the decision up front.
On the plus side, it's nice having a user system with permissions, administration, easy ways to add content, pretty good methods for handling audio, images, etc all up-front without having to do any coding. This is where Drupal shines, in my opinion. It's great for enabling technical people who can't/don't code to set up complicated systems. But that's a far cry from being an effective MVC.
If you do use Drupal, definitely use Drush (http://drupal.org/project/drush).