We had a real DJ come and start off each day in spectacular fashion over video link recently. The team LOVED it, he took requests and it got everyone awake and excited for the day ahead. Plus, it drove a great team discussion on our musical tastes! (We had https://djgraffiti.com/ - Can't recommend him enough!)
I've been using Apollo now for the last month or so, in production and I have to say that it's been a fantastic tool to work with. The community and the team behind it are also second to none out there; hugely friendly and incredibly helpful. Check out their Slack channel if you run into any issues!
Well http://mostexclusivewebsite.com/ currently has 46,000 users concurrently connected, in-line, receiving live updates, waiting for a ticket. So yeah, I would go so far as to say that Meteor can be scaled pretty well.
Firstly, your concern about security is completely unfounded; Meteor only allows you to run queries against the database if you write specific ALLOW/DENY rules to let them through. Otherwise, all DB calls go through Meteor methods that are run both on the client (for optimistic updates) and on the server (in a controlled environment). So you let through whatever you choose to let through.
Secondly, Meteor has several modules that allow you to expose Meteor methods as a REST frontend, so it's a trivial change to get that functionality added in.
Have you tried Atom since they shipped version 1.0? It's been sped up a LOT.
However, I don't really think that this topic has much to do with React / Meteor, as Meteor is a full-stack web-solution, Atom is a desktop text-editor built with web technologies (and specifically React)... It's like saying my Ferrari goes faster than your boat, yup, on land.
It's completely different from ES6, it's a full-stack framework, so it does SO much more than just a front-end framework.
Meteor's main selling point is the reactivity; you can call `Books.insert({ name: "test" });` on the client, in-browser and it then updates the UI optimistically, updates the DB on the server AND propagates the change to all other clients, which in turn updates their UIs. All with one line of code.