Firstly, your concern about security is completely unfounded; Meteor only allows you to run queries against the database if you write specific ALLOW/DENY rules

Firstly, your concern about security is completely unfounded; Meteor only allows you to run queries against the database if you write specific ALLOW/DENY rules to let them through. Otherwise, all DB calls go through Meteor methods that are run both on the client (for optimistic updates) and on the server (in a controlled environment). So you let through whatever you choose to let through. Secondly, Meteor has several modules that allow you to expose Meteor methods as a REST frontend, so it's a trivial change to get that functionality added in.