Question: So far any search for Pogoplug security risk does not bring up anything alarming. Just wondering if anyone else has run across any mention of security issues with this device.

Answer: 
Let's go down the stack and look at every aspect of its security.

* **Remote Computer**: very easily compromised on an untrustworthy computer via a keylogger, so if you either a) only access your Pogoplug from your (trustworthy) computers, b) change your password often (i.e., at least once every 6 weeks), or c) use the very awesome [Keepass](http://keepass.info) 2.x that has a feature that scrambles then descrambles the password through simulated keystrokes, the clipboard and the arrow keys.
* **Remote Computer's Internet-Your Pogoplug**: not as easily compromised because Pogoplug (if the reviews are correct) operates entirely under Secure Sockets (SSL), meaning any data between the remote computer and the pogoplug is encrypted with encryptions algorithms that only quantum computers can crack before the universe explodes.
* **The Pogoplug**: There aren't any insomnia-worthy viruses or threats out there, since it runs ARM (only common in phones) and Linux. Unless somebody launches a DDoS attack on it (which, assuming your son isn't Osama bin Laden or targeted by 4chan) means that nobody will a) be able to get into it without the codes, or b) care.
* **Your Son and His Friends**: This is the most important part because most modern schemes involve exploiting human psychology and inability to think reasonably when in immense stress. The worst thing that can feasibly happen is that your son accidentally changes the Pogoplug's privacy settings without knowing or forgetting to log out of a borrowed or public computer.

**In Summary**: The Pogoplug itself isn't a security problem, the people who use it are. And for the same reason phishing schemes are so widespread nowadays.

**Edit**: I should mention that when I was analyzing the security weakpoints, I was assuming that there's some superpowerful group of people after your son (e.g. the NSA, Al Qaeda). Otherwise the chances of people even trying the worst-case attacks I show here are nigh unlikely.
The pogoplug essentially makes a connection to the manufacturer's server and provides content through it, at least in part. In my book that is a security concern, but for most people it is no more a threat than posting your pictures on facebook and only letting your friends see them is. 

You're trusting the manufacturer to actively protect your data though, rather than passively protect it by designing a good password authentication scheme (for example).

This is based on what I've read about pogoplug which is very little recently, and a bit more, but a lot longer ago.