I think given the speed of computers these days, the fact that SP's easily help defend against SQL injection attacks would put their security-related features above that of performance...