ZMK is a new keyboard firmware software project. It is based on Zeyphyr RTOS. I guess the main keyboard firmware alternatives are QMK and TMK. .
As for security issues, new mechanical keyboards — with either QMK or TMK and I presume also with ZMK — are programmable, with layers and macros, with many opportunites to be a “BadUSB” device. Including WiFi support, not just USB. Let’s hope that peripheral firmware and operating systems learn to treat these powerful peripheral devices with appropriate caution.
PS: I’m hoping to see one of (ZMK, TMK, or QMK) support RISC-V. At this point in it’s evolution, RISC-V would be useful in more maker projects (like mechanical keyboards and #badgelife projects), in addition to FPGA-centric focus, while it evolves to eventually power a real PC. I hope the RISC-V ecosystem puts more effort into competing with Arduino and other ARM dev boards. While I believe ZephyrOS supports RISC-V, the ZMK project doesn’t.