I'm not sure about any specific security fixes (although I'm sure there were, and that information is probably listed somewhere), but I have been experiencing the slowness issue.
I've been quite reluctant to bring it up here, since one particularly pro-active moderator's response to other similar posts has been something along the lines of "No, no, no, no. La-la-la, I can't hear you! You haven't paid for anything, so go away and cry into your spilled milk.", which is both annoying and unhelpful.
Just yesterday I did a clean install of 2.7 on a GoDaddy shared Linux account. No plugins, nothing but WordPress files on the site and in the database. At first it seemed fine, but the longer I seemed to logged in to the admin area, the slower it seemed to get. After about an hour both the site and the admin area became utterly unresponsive, either hanging, failing to load certain files, or 404ing completely.
I logged off, then came back to it about an hour later and it seemed slightly better, and then after 15 minutes starting really dragging its heels again.
I don't know nearly enoough about the intricacies of the server versus the requirements of WordPress, and today it doesn't seem nearly as bad as it was last night, but I've had three different PHP geniuses tell me over the past couple of months that WordPress can be incredibly wasteful on resources. I've not had much to complain about so far, but I am becoming increasingly worried about all the reports of slowness that I'm reading.
My setup summary:
GoDaddy Linux shared hosting
Wordpress 2.7, no plugins