What are the security trade-offs between Organic Groups and other methods? I'm in the early stages of implementing a community site that will be made up of many sub-communities/groups. Most content will be shared between all groups (e.g. community-wide announcements and news), but there will be several sections of the site private to each group. For the sake of discussion, let's say that every group has its own private wiki, blog, and address book.

Very generally, there appear to be two options:


One site with some content split up (Organic Groups)
Multiple sites with some content shared between them (Drupal core multisite install, Domain Access module).


The site will be exactly the same (theme, menus, layout, etc.) for every group except that each group's private sections (blog, wiki, and address book) contain content accessible only within their group.

Content in the private sections will make up an extremely small portion of the overall content, which feels like one site to me. However, as security of a group's private content is my primary concern, I'm leaning towards multiple sites.

What are the main security trade-offs between the available methods and modules?

Edit: I am not necessarily using separate domains to accomplish this, but it is an option I'm considering.
It sounds like you are going to need to use Domain Access and set your organic group permissions to fit your use case.   

Here are key points to Multisite vs. Domain Access.

Multisite
 - One database/prefix per site, possible to share users, tables but requires tweaking.
 - Separate install for each but can share modules and themes

Domain access 
 - Single Database
 - shared content, users