The pros and cons list for rollup summary vs trigger is pretty short. In fact, you've taken care of most of the pros and cons of using a rollup summary in your question.
Rollup Summary:
Pros:
- Standard behavior provided by Salesforce, well documented and understood
- Doesn't require a trigger
Cons:
- Requires a Master-Detail relationship
- Has some restrictions on which fields can be aggregated (e.g. Can't roll up a formula field on the Detail object if it is a cross-object formula)
- Limited to 25 rollup summary fields on a single object (prior to Winter '16, this limit was 10, and you could call Salesforce Support to get it increased)
Rollup via Trigger:
Pros:
- Can work with lookup relationships (or a text field holding a parent record Id if you can't make a lookup to the object. OpportunityLineItem comes to mind)
- Can work with more than 25 fields
- Can work with a wider range of fields (provided you can write the summarization logic)
Cons:
- Requires a trigger (and some test coverage)
- Requires at least one query
- Rollup must be explicitly coded
There are a few different ways to accomplish a rollup via trigger
- Keep a map for each field you want to roll-up. Iterate over child records, and update the maps as you go
- Use Aggregate functions in the SOQL query to do the rollup.
[SELECT SUM(Field1__c) FROM myCustomObject__c]
- Install Andrew Fawcett's Declarative Rollup Summary tool
Personally, when I need to use a trigger to do a rollup, I favor using a SOQL query to do the heavy lifting. Doing it via SOQL takes care of most of the null checks, and saves writing the same boilerplate summing logic over and over.
The declarative rollup summary tool is probably the best choice for most people outside of using a standard rollup summary field. I haven't used it myself, and don't know how well it would play with various trigger frameworks.
Conclusion:
In your case, the decision probably comes down to the question of how likely you are to need to manage the security of both objects independently.
If you will need to manage them independently, or think it's quite likely you will need to someday, go with a trigger rollup (looking at the declarative rollup summary tool first). Putting your two objects into a Master-Detail relationship would leave you with a technical debt that would be hard to resolve.
If their security can be managed together, and it doesn't look like that will ever change, go with the standard rollup via Master-Detail relationship.