Open Source is not about the price it is about the licence to use. It may be free to download but that is not the point. The point is that you get the source code to modify as you see fit with few restrictions (only copyright) which is 100% better than rent by the month solutions like Yahoo, Miva and Volusion.

osCommerce wisely does not try to be all things to all stores. It provides a very sound core set of functionality on which people can build. Compared to its clunky forks and restrictive alternatives, users of osCommerce are not presented with an overwhelming Administration Panel full of functionality they may never want to use. They get the basics which they will use and can add on what they need to support their unique business model which is what it is all about.

That is the point of open source and in particular osCommerce. You can apapt it.

As for your security remark, osCommerce is secure and people should not be concerned in any way with using it.