Mac OS X branded components ( cocoa, carbon, non-gnu apps, etc.) are all closed-source, and with darwin by itself there's not much you can do. There's the kernel and modules (that's a NO), BSD/gnu userland utilities, the security framework, some gnu-based apps and services (cups, mDNSResponder, etc.).
Leopard-webkit is probably a good example of backporting software for the mac. And it looks scary to maintain.
If you want up-to-date userland tools, you should try macports instead (it has many GNU ones). There was the soylatte project that released java 6/7 builds for 10.5 ppc/i386, and for something solid that's not a good solution.
For security, except for the usual precautions, you have very few options.. Just avoid exposing the system needlessly.
It's a disappointing answer, but not much can be done for the "Mac OS X" part of the system. I may add though, part of this depend on how much time and effort you're willing to spend on getting things to work.