Security issues concerning including external code for module
If your web server is set up correctly then both of the paths you've mentioned will have the same permissions (readable but not writeable by the server), so they would be equally secure/insecure depending on the rest of your server setup.

I must admit I haven't come across a path like the second one you mention, although I know most contributed modules that have been updated to Drupal 7 use the sites/all/libraries folder for storing external code libraries.