The real problem isn't MT's hypothetical mod support, it's that people aren't building the kind of mods that you get in MC: There's no BC, IC2, AE, TC5, TE4, CC, Ars Magica, Blood Magic, TConstruct, Forestry, FMP, RC, EE3, and so on. Those mods are a big part of why MC is what it so great, and MT can't get away with just copying them: It can copy, sure, but it should also have its own mods, and they should be good ones, because otherwise there's no reason to play it over MC.
It doesn't matter how good your mod support is. It matters how good your modding scene is. And MC has one of the best since HL.
From a security perspective, this is concerning.
Lua is well-sandboxed for this, but I doubt devs are auditing the entire API they present to Lua.
And no, there are no security audits on engines like this. The only reason the mods havent installed a cryptolocker is because nobody has mad a really concerted effort to do so.
Minetest has for one a stable modding API, meaning that mods generally don't break left and right with each release. If you find a mod, chances are that it's going to work, even if it hasn't been maintained for a while. The whole game content itself is also built using this modding API, meaning that there's nothing stopping you from making mod-content, which has just as high quality as the built-in content. Or you can write your own game completely from scratch. Or you can create mods which have then again other mods as dependencies.
Minetest also has what's probably best described as "Modpack as a Service". When you connect to a server, your client downloads the mods that the server has installed and applies them. This means that you can play on a modded server without making any changes to your client. You can just connect to random servers to take a look at the different mods that exist, without any hassle whatsoever.
This also works in singleplayer, i.e. you can play with different sets of mods on different maps, again without hassle. You just use the built-in mod manager to enable the mods that you want on a per-map basis.