Minetest has for one a stable modding API, meaning that mods generally don't break left and right with each release. If you find a mod, chances are that it's going to work, even if it hasn't been maintained for a while. The whole game content itself is also built using this modding API, meaning that there's nothing stopping you from making mod-content, which has just as high quality as the built-in content. Or you can write your own game completely from scratch. Or you can create mods which have then again other mods as dependencies.
Minetest also has what's probably best described as "Modpack as a Service". When you connect to a server, your client downloads the mods that the server has installed and applies them. This means that you can play on a modded server without making any changes to your client. You can just connect to random servers to take a look at the different mods that exist, without any hassle whatsoever.
This also works in singleplayer, i.e. you can play with different sets of mods on different maps, again without hassle. You just use the built-in mod manager to enable the mods that you want on a per-map basis.
The real problem isn't MT's hypothetical mod support, it's that people aren't building the kind of mods that you get in MC: There's no BC, IC2, AE, TC5, TE4, CC, Ars Magica, Blood Magic, TConstruct, Forestry, FMP, RC, EE3, and so on. Those mods are a big part of why MC is what it so great, and MT can't get away with just copying them: It can copy, sure, but it should also have its own mods, and they should be good ones, because otherwise there's no reason to play it over MC.
It doesn't matter how good your mod support is. It matters how good your modding scene is. And MC has one of the best since HL.
From a security perspective, this is concerning.
Lua is well-sandboxed for this, but I doubt devs are auditing the entire API they present to Lua.
And no, there are no security audits on engines like this. The only reason the mods havent installed a cryptolocker is because nobody has mad a really concerted effort to do so.
MineTest is open source and has modding support as a feature.
They did say that Java MC isn't going anywhere.
Their stated intent is to make add-ons/plugins as powerful as they can, but there is a limitation in that they want them to be able to work in environments like iOS. Add-ons sre no problem: they're just json data files. They think they'll be able use use C# plugins on iOS, but I'm quite interested to see how they pull that one off.
Regardless, there are 30-40 million players of MCPE who have no modding at all today. This new system is going to be a big step up. even if it is entirely different from the way Java MC is extended.
Embrace, extend, extinguish is how it always plays out.
I personally don't think that Mojang would do that unless forced to, especially given what would happen to the community. Most likely established modders would continue to use JMC as their base, pushing new modders towards doing so, and thus it would continue to overshadow other versions, as the mods really do make the game.
Then there's the mods that break between versions. You can have mod A, B, and C on 1.8.1, but only A and B on 1.8.2 and only B and C on 1.8.3.
However, the sites are usually MCForum or Curse, neither of which are especially shady, and I've never seen a mod packaged as an exe by its creator. You're probably looking at the cites that host a collection of mods from other sources, which are about as shady as their software equivalents: sites like cnet, etc.