Off-the-shelf frameworks, while definitely useful, have one disadvantage: they need to cater to a wide range of needs, and so they have to balance the required level abstraction vs. the maximum tolerable degree of complexity. That is, in order to be generic enough to support all possible use cases, they tend to be more complex than they would have to be for each individual project.
At the same time, the advantage of such frameworks grows with their user base: the more popular a framework, the more likely it is to have seen rough real-world exposure, which probably means it's been tested and fixed more thoroughly. The same goes for any other piece of code, naturally, not just frameworks.
This means you have two viable choices:
a) Go with one of the popular frameworks, get to know it well, and learn how to bend it to your desires. Most of them are flexible enough to get you there, even though some things might be harder than they would have to be in a perfect world.
b) Roll your own. A minimalistic MVC framework doesn't really take that much: a controller base class, a model base class, a template system, and a bootstrapping script that takes care of configuration loading, routing and autoloading and such. For database access and templates, you can use existing solutions; there is an abundance of ORMs and template engines for PHP, but at least for the ORM part, again, writing your own isn't that hard if you know what you're doing.
One final note: you list "security" as one of the desired characteristics. This sounds as if you expect a framework to be able to solve the security problem for you, but it doesn't work that way. A system is as secure as the weakest link; the best a framework can do is not be the weakest link, and provide you with some tools that help you avoid common problems. Textbook examples for such tools include a template engine that automatically HTML-encodes variables (which protects you from XSS vulnerabilities), a data access API that uses parametrized queries (to avoid SQL injection), a forms API that takes care of CSRF protection, etc. But note that even a framework that gets every single one of these things 100% right does not give you "security": you can still make mistakes, and those mistakes can still translate into vulnerabilities.