Well, asop/cyanogen on a tablet w/o gsm/4g should be pretty safe. About as safe as computing gets these days... now with play services, you obviously add a backdoor to an otherwise reasonably trustworthy system...