I could answer all of these questions for you
MPA vs NATS : NATS ( Bigger user base, more upgrades, more potential for B2B and imo B2C )
Elevated X : Be prepared to learn things, and lots of them, better then the other CMS products out there. I will give this to EVX, unlike other idiot companies, they take in code changes and code requests seriously. We had issues outside of their support, and asked if we could get some time with snippets of SRC to build a solution that they could roll in, and that was huge. Most companies are scared of this, but its foolish, b/c if you shun your customer long enough, he'll find something else.
As for NATS, the learning curve is pretty easy, advanced stuff is pretty steep. the more you play, the more you know. They are serious about their support, but they aren't babysitters. Often times I think people want them to admin the program, when they refuse to learn, and that just clogs up the queue.
Nothing is 100% un-hackable, un-leakable. Any time you have to interact with something, there is always room for exploits. I'd not suggest anyone judge software on that criteria unless you're willing to take into account how fast they reply.
We sent NATS for example a found exploit on Approval Pages, they fixed it for all clients within 3 hours and sent out an update ticket to all to run the file fix.