As someone who is deeply involved in this (I wrote the code on the security property page and I'm updating the signing page), I can tell you that we are NOT taking security lightly. We work closely with the Windows team to make sure we make the right security choices going forward. The CLR security team is a key contributor to the ClickOnce effort.
Security is ALWAYS on our mind when we design, implement, and test ClickOnce.