Update README - wrongly implies that security hasn't been (very) actively considered