Awesome news that you got it!
Security - not started seems to be popping up often on folk's GCMS notes so I wouldn't worry about it. I conjecture that it may be as simple as the VO hasn't asked to pull the results yet (since my understanding is that security is done by external agencies). Or, it's still a GCMS transition....I doubt they are just sitting on them. Check the detailed section for action/communication with external agencies, which may give you much more insight in the details.
The due date is the date that things are due on your file and the next time they will therefore look at it (unless something triggers them to look at it before).
Medical I also take as good news - they probably saw your case enquiry and asked for the results to be pulled
Exciting to see movement. Next step - PPR (soon!)