In my opinion a flash animation still outperforms a CSS-based animation in many cases. The problem with flash was never that it was inherently slow, but that people abused it to do slow things. On the security front though, you are absolutely right.
The performance side has nothing to do with animation performance and everything to do with the resources used to achieve it. Flash will murder a macbook's battery and generate an absurd amount of heat, doing nothing more than streaming h264.
That's so true, and as more and more ads go HTML you will see crappy devs animating the dom resulting in poor performance on iOS devices and damaging battery life.
[1] primarily because there are no viable competing implementations to what Adobe puts out