For me the main draw of Mastodon is that my interactions with it aren't being increasingly optimized for revenue.

There are no ads in my feed, and no opaque algorithm determining what I see.

Data security is a concern of mine, but I don't think Mastodon is any more or less vulnerable to attacks than any other software.