1. Has NetBSD done a security code review at some point in recent
      history?  Yes, I know that they don't have anywhere as many reports
      on Bugtraq as NT, but the security weenies at work are gonna try and
      nail me on this one.

a large portion of the NetBSD source tree has been audited for the most
common security issues.  several other security-related projects and
changes have been implemented also (see the NetBSD security web pages).
   
   2. Will the recently imported KAME stuff provide IPSEC for IPv4?

i haven't done this personally yet but i believe so.
   
   4. Soft Updates?  I know that there was some work to integrate it.  Did
      it ever get integrated?

as i understand it, this work is on a branch (and thus available via
anoncvs) but has problems with unmounting filesystems.
   
   5. Is the Xircom CreditCard 10/100 CE-10/100 multilink card supported?

i don't believe i see support for 100mbit xircom cards, but the 10mbit
ones appear to be supported; you may be out of luck.