What bothers me more than root access is the fact that any 3rd-party app can access all my data easily, as mentioned earlier by erendorn.
Like Angry Birds accessing my address book and sending it elsewhere, for example. That's where action is needed.

You may want to try SHR and Nemomobile for n900.
Maemo is much more usable, but contains more proprietary software.
SHR and Nemomobile have proprietary software only in kernels - hardware adaptation part.

Anyway, Maemo currently is much more useable, I think.

What about security, I would say, it's not that bad.
Default email client in Maemo supports encrypted connections,
So I use it with TLS connections to my own mail server, which is hosted by me.
There is a sylpheed port (Maemo is just another GNU/Linux based distrubution, and it's one of the major advantages of Maemo over Android - we can use Pidgin, Sylpheed, Frozen-Bubble, etc) and I believe Sylpheed supports gpg encryption.

I also use IM accounts to connect to my own jabber server.
I have got SSL certificate from startssl.com, and my server is able to connect securely to jabber.org, so I can chat with it's users. Actually it works with any server, except Google, talk.google.com connects with my server without encryption.
This means that my chats with google users is possible to sniff by someone between us. Here it comes that if I want to safely chat with someone on google, I need to use gtalk account.
Here we have another question - safety from who?
Cause if you chat with someone on Google, Google knows what you talked. On the other way, sometimes it is more important that your country's "secret service" won't be able to dump your chat, rather than google, cause google is not interested in your activities, but they are.

I have to add, that I do not use regular cellular provider account, I took internet only sim card, and according to the law in my country it must be registered with passport. That means they can always get your location if they know who you are. That is why it is better to get some tourist's old sim card, when he moves back home, then if nobody knows who is the owner of the sim card, they cannot track you.

Yes, I am not able to do regular phone calls, however I do not need to. All my friends are online in jabber, when they want to be accessible, so I can make a voice call over xmpp if necessary.
If they are not oline, that means I need to write an email.

I actually have a SIP provider account, and configured my n900 to use it, so I can turn it on in case of emergency, and I hope I would never need to use this im account.

So this are some points from my experience, about how to be more or less safe by using a mobile device, and that's device is of course n900