security and contributed modules

basically, i feel like i'm lacking information for making an informed decision on security issues and i don't know where to get it, so maybe someone can point me in the right direction:

i am evaluating web content management systems for a small non-profit organization. so far drupal seems to be the best suited system for our needs because of its modular nature: we can start small and activate or add modules as demand for more complex functions increases. as i will also have to install and administer the system, i worry about security though:

- drupal core:
this will be the first wcms i'll administer and i know next to nothing about security, so i wonder if everything that i'll have to do in order to keep it safe is described on the small security node (http://drupal.org/node/27573)? after reading some random security advisories this seems to mean that i'll just have to update to every new version as soon as possible.

- contributed modules:
it seems updating to a new version might break compatibility of contributed modules though. as i looked through available modules, there were many that weren't available for 5.0 yet. additionally the page about the 'Security team' http://drupal.org/node/32750 states that seemingly unsupported modules will be removed. does this mean that it is safe to use any available module, because if it weren't safe, it wouldn't be available on drupal.org? or does this rather mean that contributed modules should never be used from a security point of view, as it may well be that after a month it'll have to be disabled and break the site's functionality because an issue hasn't been fixed?

in my particular case, i would need an "image"-like module for enabling contributors to create image galleries of recent events, and a module like "Taxonomy Access Control" for private forum content. i had a look at the issue reports of those modules, and it does seems like they are both well-supported. displaying images that have been contributed by the community seems to be a common task though, so i wonder why core hasn't got that feature? are there security issues? and is it wise to rely on a contributed module for security-related functions like handling access control?
maybe it would be helpful if the drupal security team would publish a security rating for each contributed module, so users would know just how much they risk by using a particular one, though i guess the additional workload would be hard to manage and it's also hard to evaluate security. maybe using an automated rating system like "green" for modules that have been consistently supported for the last six months, yellow for relatively new modules with no known problems, and red for modules having critical, non-fixed issues, would be a possibility to handle it?

i know there never is absolute security, anything you put on the web is potentially made public or stolen. luckily, any leaked information from our site wouldn't result in any deaths. but i still don't want to run an unsafe site. so is drupal with selected modules safe enough for our needs, or is it better to use another wcms? that's where confusion comes from: on the one hand, security tells you to keep it simple, only install what you really need, which makes drupal look pretty safe and appealing to me. on the other hand, a bloated, but with consistent security updates for everything included system might be a safer bet if you're not a security expert able to fix any issues personally (though i haven't found one yet that has fine-grained access-control out of the box). i do realize that the easiest solution would be to get paid assistance for running the site, but alas that's not an option. i would appreciate any thoughts on the subject, as i am rather lost at the moment. i feel like i read just enough about security issues to get scared, but not enough to evaluate the actual risks realistically, so any pointers are welcome.