rjjacob basically hit the nail on the head here.
I still sense a lot of ‘old’ thinking around the web regarding these two systems, and its really down to the fact that they arent understood.
Security is a moot point really, as thats not something that is up to the system alone. Any WordPress/Joomla/Drupal site can be compromised if the environment supporting it is not also secure. If meant in terms of quick response time to vulnerabilities, i’d say both are equal.
Here is where the debate really is interesting. Drupal’s power comes from just how extensible it’s modules make it, and with a bit of coding knowledge, one can easily build a highly complex site. However, to say Joomla is not extensible would be doing it a great disservice, as it’s MVC Architecture actually makes coding relatively complex extensions quite straightforward. Even without any heavy PHP coding, layout and template overrides are quite powerful.
3. Popularity ( more work available )
This is an interesting metric. There are ultimately more Joomla sites in existence, but Drupal powers sites for larger entities. Take from that what you will.
4. HTML5 and CSS3 support
I believe ‘CSS3 support’ is something entirely up to us. HTML5 support i believe is accommodated in both Drupal 7 and Joomla 2.5.
5. Ease of upgrading from one version to another
Moving from Joomla 1.0 to 1.5 and from 1.5 to 1.6 i must say was an excercise in pain. The same can be said about the move from Drupal 5 to 6 to 7. Joomla 1.6 to 1.7 to 2.5’s upgrade process was much better however, and if this is how it will be in the future, is very encouraging. Same i hope for Drupal 7 to 8
6. Community support
Both have very active communities, but i must say Drupal’s is far more invested.
As with everything. Each system has their particular usage scenarios.