Is it that the core Joomla files are perfectly stable and it’s just certain extensions that suffer security issues?
Generally, Joomla is fine. It suffers from a steady stream of security issues not prevalent in EE, and, by nature, the Joomla structure makes it very easy to set up, very difficult to customize.
Add ons of any kind may present security issues, of course. Choose wisely.
Also, what about if you need a certain custom module, something that is not catered for in the EE module list? Are new modules easily customisable?
By definition, any new add on (module, extension, plugin) is what it is, and may be customizable and maybe not. Each will provide a feature set that may or may not fit what you need. Same math. Choose wisely.
If so, would this then create security risks with EE?
Sorry, same thing. It may, it may not. Choose wisely.