I see that this thread is a couple of years old, but I'll put in my 2 cents while I continue looking for discussion of management software.
There's nothing inherently wrong with having an open source program plug into National's system. Online security comes from good authentication methods, rather than praying that a bad guy doesn't reverse engineer ScoutNet's protocol.
I'm not totally onboard with the existing ScoutNet certified packages for a couple of reasons. One, if they go belly up or are bought out for some reason, I'm out of luck. Two, since none of them are currently web-enabled, they make a troop's designated record keeper's (for advancement or rechartering, say) job easier, but do nothing to inprove getting the info to the other leaders, parents, or kids.
I recognize that putting a server on the web adds to the risk of information disclosure from any one troop. But, knowing nothing about how the BSA set up ScoutNet (other than guessing that it's an '90's style VPN and client-server setup), I can't say that National is handling security any better than I can.
For what it's worth, I see that Jay North has been through a few revs with his GPL'ed 'Scout Tracker', a pretty straight forward LAMP web application.