Please define suckless. See on under suckless.org one can find rocking software, meaning suckless alternatives not developed/maintained by them, and on the editors section I see:

• acme - Rob Pike's framing text editor for Plan 9. Included in plan9port.
• ed - ED IS THE STANDARD TEXT EDITOR!
• ired - A minimalist hexadecimal editor and bindiffer for p9, w32 and *nix.
• mg - A portable version of mg.
• mle - A small, flexible console text editor.
• nano - A pico clone - this is small simple code and easy to use.
• neatvi - A minimal vi implementation supporting bidirectional UTF-8
• nextvi - A continuation of neatvi development with more features.
• nvi - A small, multiple file vi-alike.
• micro - A terminal text editor, written in go with common key bindings like ctrl-c to copy and ctrl-v to paste.
• sam - An editor by Rob Pike with inspiration from ed.
• sim - The sim text editor. Based on vim and sam.
• traditional vi - A fixed version of the original vi.
• vim (With the GUI, use :set go+=c to kill popup dialogs). It can be compiled to be as minimal as possible (see vim-tiny in Debian repos).
• vis - A modern, legacy free, simple yet efficient vim-like editor.
• wily - An acme clone for POSIX.

That said, also note there's an emacs-nox package available in most distros, which only includes the editor able to run on a terminal emulator, if emacs OS is too much. And can you share URLs justifying why vim is a big security hole? BTW I don't see neovim as part of the suckless.org/rocks software. What is suckless depends a lot about what one might consider it to be, even though there might be some common characteristics that can be recognized as not good such as bloated, too big code base and so on.