I have very extensive experience with mambo and joomla. I spent a few weeks downloading templates. Ive been a part of the Joomla community since it began and the Mambo community since the early days (Joomla is a fork of Mambo which formed when the Mambo dev team quit in protest to form their own CMS) and alot of the addons/templates/etc used to be totally free. But the new path of Mambo toward $$$ and business solutions has likewise steered the Joomla community in a similar direction. Now most modules and templates are only available for a fee and most of the information on working with both CMS's require you to register with a site and pay monthly fees. I have amassed a huge repository of Mambo/Joomla templates, modules, addons and scripts. If youre interested I would be happy to help you set something up.
As for the security issues, I would not go with Mambo. Mambo is now geared toward corporate/small business solutions and is really designed to have a dedicated support person/team keeping an eye on it. Joomla however, stuck to the developer's concept of a CMS for many applications. The unfortunate side effect of Joomla/Mambo's ease of use is that many people ignore the advanced settings to make their backend secure. There is a hardened Joomla distrobution that is much more difficult to hack, but security is all based on how much work you want to put into it. Hardened PHP can be difficult to deploy, but there are several settings which, when enabled, make the CMS considerably more secure. These settings are turned off by default to lessen compatability issues when installing on the server. Most people simply dont know or forget to activate these settings. The security flaws with Joomla/Mambo are flaws that are in all CMS's and PHP which are amplified by ignorance of the user. Learning the software is key to keeping it secure.
