Er... Interesting assertions.
SARK does not use the AMI to manage multi tenancy and neither does it's main competitor in the UK. For that matter, neither does the German multi-tenant Asterisk implementation used by Gigaset, among others. Of course this is dependant upon just what you mean by multi-tenancy, but if you mean multiple companies sharing a single PBX instance, usually because they are collocated in the same building or campus, then external code interacting through the AMI is not a requirement to control it. It can be done using the inbuilt Asterisk concept of context plus the logic to distribute call flow according to database vectors. As to the assertion that it is insecure because of some shortcoming in the Asterisk architecture, or why it is any more or less secure than any other Asterisk implementation then I guess we would have to ask HF to explain.
No, I will not explain for it is common knowledge and out in the known asterisk related discussions forums. Digium itself strongly advises that Asterisk was never designed to be a multi tenancy telephony engine. Heck it is not even supported an any Digium core or Asterisk official derivatives.
As for UK competitors to SARK, this is a global community. Did any of the Sark devs talk to our Indian or Chinese collegues? I'm happy to bring you in to contact with them if you speak Indian, Hindi Cantonese or Chinese.
The world is bigger then one could assume....
ps. it took the SARK devs another 2 weeks to even reply to a very specific SARK related question.