You don't need to trust the security of pubs. Validation of messages happens through cryptographic signing and public messages are public anyways. You also don't need to trust that pubs will be online much because your followers will also help host your content.
> So, if I post a GB worth of diary entries, who ends up caching it by default? Just my followers? People I follow? Pubs I connect to?
your followers, their followers, and their followers (assuming everyone is using the default replication settings). These may include pubs or people you follow. If you are able to connect to a pub then most likely it is willing to replicate your feed.