1.) I still can't guarantee it until it reaches Debian or Ubuntu Linux distributions, which I test it on. My guess is it should work just fine, I'm not aware of any specific compatibility issues, but you never know what can pop up from under the woodwork.
2.) I'd argue Composer keeps Tinyboard more secure by making security related updates to dependencies as simple as a command. If exposure of these files is a concern to you, I'd be using something like .htaccess to deny viewing access. Also, Github tracks security risks that your project may have if you use a Composer dependency file. vichan is not actively developed with the exception of paid support/security.
Also, I'd like you to know I'd appreciate if you didn't create a thread for each reply you have to my comments, as well as keep the uploaded content SFW on the SFW boards. Replying to a thread and following site rules should not be a chore. Thanks.