gstreamer is not that complicated

Last time I checked there's a small industry of gstreamer contractors, so it's not that simple.

It has a really really crappy security record, though.

Those issues are typically from the decoding libraries you choose. Which could even be ffmpeg if you wish. GStreamer just provides a nice high level API.