It's not that you are being too paranoid (the questions 'what happens if my CMS ceases development' and 'what happens if my CMS has a security bug' are good ones) - it's that you are being incorrect in your analysis of how bad that is, and what to do about mitigating them.
Starting with 'what happens if development ceases' - In the case of an open source product, if everyone else in the world gave up on the thing, you'd still have the option of doing it yourself, WITHOUT having to start from zero. Since that's unlikely to happen all at once, you'd actually have a good bit of lead to time to decide whether to hire devs, or switch, or whatever. Obviously Joomla suits your needs at the moment, so re-inventing the wheel at this point is a complete waste of money. The amount of work involved in writing a full-on CMS is NOT small.
On the subject of security bugs - it is FAR more likely that you'd introduce security issues into a bespoke product than if you use one that lots of other folks are constantly fooling with and which has a fairly high profile like Joomla. It's unlikely that your initial efforts wouldn't have at least a couple of major security flaws.
If you are really interested in mitigating these concerns to the greatest possible degree, then I'd advise you to hire a developer or two to perform security analysis and fixes on Joomla itself. The idea here is that instead of re-inventing the wheel, you'd make the wheel you're already using more secure by fixing problems, and you'd have an in-house dev already familiar with Joomla in the event that you did need to take over development completely.