How robust/(un)safe is CI

[eluser]johnman[/eluser]
I am a new user and i don't want to flame CI since i really like it a lot. But i personally think safety of any framework should be the prime concern so forgive me if i sound blunt. Its just because i want to get some clarity about this subject.

So far i am very impressed with how smooth everything goes with CI, but i am very worried about its robustness and safety. In a very recent topic (http://ellislab.com/forums/viewthread/53203/P0/) someone noted CI is NOT always escaping properly which can be a huge security risk (if i am not mistaken). The reason i am worried is because my assumption that CI was making my web-system safer might be incorrect. Now i believe the biggest security risk is actually CI itself. The escaping bug is very easy to see, even if you just briefly glance at the code, very easy to fix, but it is still in the current release. That makes me wonder how good the quality of the rest of the code is. Has it been reviewed by other professional people? How has it been used and tested ?

The second question is about the callback validation functions. You can use i.e. callback_username_check as a parameter for the validation class. So you need to make the function username_check for checking which is a PUBLIC function and therefore can be called from the browser. Shouldn't this function be private? I know you can fix it by using a double underscore, but this should at least be mentioned in the userguide. I'm not a real php programmer so i might be wrong but currently i come to the conclusion this is actually a design fault. It would be safer to have all functions private unless you explicitly make them public.

I only used CI intensively for a couple of days but if these 2 problems already arise, i am worried about how much more problems i am unaware of. I hope one of the developers can give some clarity about how much of a priority security is to them.
And please don't think this is some sort of rant for not supplying the update we all needed yesterday. I just try to give some context on why i am worried and reluctant to use CI as a framework.