May not add security in and of itself, but it certainly adds the ability to have a little extra security. Put your reverse proxy in a DMZ, so that only it is directly facing the intergoogles. Use firewall to only expose certain ports and destinations exposed to your origins. Install a single wildcard cert and easily cover any subdomains you set up. There’s even nginx configuration files out there that will block URL’s based on regex pattern matches for suspicious strings. All of this (probably a lot more I’m missing) adds some level of layered security.
This is a pretty accurate summary from my experience. The only thing I’d add is that (from what I’ve read at least) some form of ‘smart’ album functionality is high on the priority list and shouldn’t be too much further down the line. It may be a more advanced customizable logic type of solution (again from what I’ve read) but the functionality of putting person(s) ‘x’ into album(s) ‘y’ (or similar) should be achievable.