It is adding a dependency on the Brave developers not to mess up and create security holes, in addition to whatever trust you place in the Chrome project itself. (A browser plugin requires somewhat less trust since it's sandboxed, but the permissions are still pretty scary.)
But I guess it's like buying an Android phone from anyone besides Google? Or installing packages from Debian and hoping they fix more security issues than they add, compared to the original developer. It's usually true, but not always.
I think the risk they add from a security perspective offsets the risk Chrome brings from a privacy perspective.
I should really switch browsers on my phone; while brave works OK the fact that their revenue model is broken should signal that they will likely need to do something shady in the future. I never opted in to BAT simply because I figured that maybe 1% of the sites I visit would be opted in to the program. Plus, I'm not going back to watching ads.
Brave with the BAT features turned on still uses its builtin adblock.
From there, I think you need to state a bit more clearly how is their revenue model broken.
For me, it's still the most acceptable "major" Chromium-based browser.