Security implications of bitcoin.conf location
I do not see the "necessary" relevance to bitcoin here. File access security is better discussed in unix relevant stackexchange. Still I'd like to share my view with the little bit of bitcoind relevance.


  One argument against using ~/home/.bitcoin/bitcoin.conf I thought of
  is the RPC Password is be stored in the .conf file and could be viewed
  by anyone with read access.


depends how you setup your bitcoin system. If bitcoind is setup as a user related process, it makes absolutely sense to have bitcoind.conf in home directory. You may then secure the file with "chmod 600", so only the owner can read/write the bitcoind.conf file (and root and/or the admins after tweaking the permissions).

When storing in /etc, the "chmod 660" makes more sense, then owner and group can read/write the file. In this case I'd be having bitcoind running as a systemwide daemon. But to be honest, I haven't seen such a setup discussed anywhere. This would be ok for a static setup (using shell scripts to startup), but imagine you use it every day for tx generation or status checks. Every call to the bitcoind executable would require the correct path to the config file, and if not, bitcoind creates one (in your home dir), and then it might give RPC access problems... 


  Item #2 Similar to #1, besides +1 style points, is there any advantage
  to moving logs to /var/log?


This again depends on the distribution used. My OpenBSD uses syslog (to /var/log), whereas the OpenSuSE systems have introduced last recently the journal system, where all logging is in a database. I must admit, I am more comfortable with /var/log, but when my beloved OpenBSD would also go away from /var/log, then what to do with bitcoin system logs?
So generally I'd say, /var/log should remain for the unix system related logging, and each application (I consider bitcoind as an application) should have it's own log (and related directory). This makes separation of duties on a larger unixoide system more easy, and the sysadmins wouldn't find irrelevant data in their well known /var/log directory.