I don't work at NASA, but I'd say it's not important to do much security testing on the spacecraft software itself - there's little connection to the outside world other than sensors. Or at least, that's my impression, I assume rockets don't connect to the internet.
NASA infrastructure itself must be secure though, it seems likely that other countries would want to cause trouble or at least steal technology.