I've been tracking down the SecurityID issue for the last 4 hours. Finally got to the bottom of it, but I don't have a fix right now. It boils down to what appears to be faulty coding by Silverstripe, but I'm not entirely sure.
When the loadDataFrom() method is executed, it tries to get the value of each field name. The first check it runs is whether the object has the method "FieldName". SecurityID passes this test, because ViewableData contains the function SecurityID() -- probably patchwork to make it work with the form class.
But then, instead of just invoking $object->SecurityID(), it calls $object->__get('SecurityID'), which looks not for a method named "SecurityID", but rather one named "getSecurityID()". This is a huge hole in the code, and i'm really surprised that other stuff is not breaking.
I have a support call scheduled with SS. Hopefully, they're willing to support the trunk version, or at the very least, tell me this will be cleared up by RC1, because I'm at a loss.