Building your own CMS is not cool unless you are as big as http://www.covers.com, http://www.casinomeister.com, etc… where you have the time, money and need for it to warrant hiring a programmer to do it for you. If you did hire a programmer you are putting yourself at risk that the programmer does things their way and if they jump ship you are left with a system that isn’t very useful and you put yourself at mercy to the programmer. I have seen programmers before who know the person who requested the software can’t afford to back out of the deal where the programmer would magically produce problems that would cost more money or give them an unfinished product that required more money to finish.
I am more familiar with Joomla but I hear Drupal is good too, just depends on your needs. Regarding security issues I wouldn’t let this get in the way of doing what you want to do, but be aware of it. I would recommend you find a php programmer whom you can hire from time to time to help with security patches and such.
John