As much as I like the idea behind Timber, I'd not recommend using it for a production site. It has some current security issues that the devs seem to both not understand AND to not be much concerned with (a frightening combination). Don't want to get too specific, but searching their github issues for reports on the usual suspects (SQL injection, etc) should show you all you need you know.

With the coming of WordPress REST, I'm hopeful that a group more secure minded starts working on WP templates.