How can I evaluate the security of a contrib module?
Currently there is no correlation between project status and presumed security of code. From The Security Team Handbook page


  in general the team does not review core nor contributed code


The Drupal security team works to resolve vulnerabilities that others find. Any review that happens to sandbox modules would be part of normal project review (no guarantees). When code is explicitly reviewed for security, it is most likely because someone was hired to review it.

In general, you can use the Writing Secure Code guide as a starting point. Also checkout presentations from Cons and Camps.