Nice outline of pros and cons of two security models (closed vs. opensource), expression engine (ee) vs. drupal. Of course, lullabot also is closely tied to drupal, so take it for what it is worth.
http://www.lullabot.com/articles/drupal-and-expressionengine-security-models