We ran numerous tests and concluded having a blog in a subdirectory is better for SEO than having a blog on a subdomain because it seems like the blogs content gives more ranking juice to the domain and thus the stores content.
In terms of security of course it's not as great as having an individual (sub or not sub) domain.
As for which system to use: think about what you'd like to do with your blog: do you want it to be a complete blog that people would also visit if it did not have a store behind it? Or do you just want to add some content to your site so your store gets more visitors / seo juice? If the first, go for wordpress. If the last, use cs-cart.