John Carmack: "I agree with Microsoft’s assessment that WebGL is a severe security risk. The gfx driver culture is not the culture of security."
http://twitter.com/#!/ID_AA_Carmack/status/81732190949486592
Security risks can be overcome. The implementation can overcome risk, as Chrome and Firefox's secure implementations prove. So the fact the risk exists is not a complete justification for not supporting the feature at all.
Given that it conflicts with Microsoft's strategy anyway, the conclusion is the security concerns are used as an excuse rather than a reason.
And it doesn't even seem like a lot of people are actively leaning on Chrome and Firefox's WebGL implementations, so calling them "secure" seems a little premature.