Yes, in the current version of the control the OnClick event is missing by design. We might reconsider our decision if we get more requests for scenarios like the one described here.
As on the second point, security trimming is a feature of the site map provider - it should not be related with the control which is databound.
You can find more information in Google or read the following MSDN article. Also Scott Mitchell wrote a nice tutorial with source code.
the Telerik team