The Sony Reader is using a Linux OS, probably pretty similar to iLiad's, at a guess. (shrug) Not sure what that means for OS security. But the OS should be solid and reliable, since they've been around long enough to know how to work the kinks out of a new product.
As for their hardware, I've
always been impressed with them on that front, even when I didn't agree with some of the decisions. Nobody uses cassette tapes all that much anymore, but everybody
still knows what a Walkman is.
If you're worried that they haven't learned anything from the root-kit debacle (understandable, that
was pretty heinous), you
could just not use the Connect software -- you don't need the software to load files on the Sony Reader via memory card or USB, only to buy books from Sony's store. (shrug) General consensus around here seems to be that most folks don't plan to do that regardless.
Surely not even Sony can root-kit you with software that never leaves the box.