We've got a very large Plone installation. I'm not a giant fan of Plone because it's based on Zope and Zeo, both of which can be giant hogs as far as resources go. You also need to have a load balancer and squid in front of Plone in my experience if you expect any level of performance.
Personally, I like and have used most of the PHP-based CMSes, blogging software, etc.
From a security and scalability point of view, the type of software that writes static HTML files up to the server is easiest to implement on a broad scale (many sites, many users) -- whether it's web-based or client-based. You can host sites that way with a minimum of resources.
If your needs are small and you want to go dynamic, look at Wordpress. It's more of a CMS than a blogging tool at this point and has a really rich feature set, template set, and plugins, and is relatively easy to develop for.
If your needs are larger-scale, then you're going to get into systems like Plone. Plone met our needs because of it's rather extensive ACL system.
With any tool that has a broad user base, you're not going to run into a situation where you have major security holes sitting out there in the open for long. I'd be leery of anything that has a very narrow scope or a tiny user base. For the same reason, I'd be leery of rolling my own when SO MUCH work has been done already to develop and secure this kind of system.