BuddyPress.org

Markup validation or malformed markup does not really correlate to lack of security.

Whereas WP strove to produce valid markup that would pass validation against DTD schemas there was always a fundamental flaw to maintaining that valid code which is third party coding i.e plugins, sadly when you allow third parties to introduce code/markup to the application you lose control over this aspect as plugin authors will have varying degrees of proficiency where frontend coding is concerned.

BP by and large – like WP – produces valid acceptable markup (we’ll overlook empty clearing divs ) however as one starts to add the vital and necessary plugins into the mix this valid code very rapidly falls apart. You can spend a lot of time if you so choose correcting these plugins, chasing down a heap of markup errors, but it will be a somewhat never ending task and not really that productive a use of someones time. Currently looking at our index page shows me 33 errors mainly produced by a video sidebar widget, most of these errors could be corrected, doing so in this instance largely a waste of time.

Interestingly /activity/ directory produces a fully compliant page, what page are you seeing your error on?