docs(security): add OpenClaw vs Claude Code security assessment

Data-driven comparison covering 9 CVEs, 10 security categories,
and attack surface analysis. Based on published research from
SecurityScorecard, DigitalOcean, Sangfor, and OpenClaw official docs.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

README.md

@@ -195,8 +195,21 @@ The repo includes working security hooks:
 - `hooks/post-tool-use.sh` logs all tool executions
 - `.claude/settings.json` has a permission deny list
 
-Read `security/` for the full picture, including an honest
-comparison with NemoClaw's enterprise security.
+### Why this matters
+
+OpenClaw had 9 CVEs in 4 days (March 2026), 40K+ exposed instances,
+and 824 malicious skills in ClawHub. Claude Code's architecture
+eliminates most of these attack surfaces: no gateway port, no
+public marketplace malware, no plaintext credentials.
+
+Read `security/` for the full picture:
+- `openclaw-security-assessment.md` — data-driven comparison with
+  CVE analysis and 10-category head-to-head
+- `nemoclaw-comparison.md` — honest comparison with NemoClaw's
+  enterprise-grade kernel isolation
+- `hook-based-guardrails.md` — building custom security rules
+- `permission-modes-explained.md` — the four modes explained
+- `auto-mode-explained.md` — AI safety classifier for autonomous use
 
 ## License