"And what the security landscape looks like since you can interact with the data store via your browser's javascript console."
By default, Meteor is in a "development" mode where all the security is off while you get the app doing what you want on localhost. The security is implemented later by turning off the autopublish feature and using authentication at the pub/sub level in the "model" component of the MVVM stack. At this point, when you try to do what they do in the demo, and change data from the browser console, it will make the change in the client for a split second, but that change is rejected at the model level, and the client resyncs with the model and the change is undone in the view.
BTW, I only "learned" (i'm not at all an expert) Meteor a few weeks ago (although I've been following the project since they first announced it 10?? or so months ago.) It's actually pretty straightforward once you get the hang of it. But it is unmistakably a BIG FRAMEWORK in the Rails sense, whereas everyhing else in the Node world is truly modular in the Node fashion, with full transparency into what's going on. For people who like that, check out Derby, and it looks like there is some more stuff in the pipeline with Rendr by the dudes at AirBnB.