Using an existing CMS framework inevitably inverts the priorities. Instead of focusing on building a system around your core 10% of unique functionality, will now be focused on trying to jam your square peg 10% to fit into the round hole of the 90% the CMS provides.
This changes the way you think about your project. Now, instead of thinking about creating something tailored for your needs, you will unavoidably find yourself thinking about how to bend your needs to fit the flow of the frameworkexisting CMS. You will do this because anything else means swimming upstream.
These difficulties will occur despite the very best efforts to generalize the CMS framework (which I'll refer to as just a "framework" here). Because you can't have a completely generalized framework without having the full expressive power of the underlying programming language allowed within the framework.
Let's also not forget that years from now, you will be at the frameworkCMS maintainer's mercy for updates or else you must maintain a copy of the frameworkCMS yourself.
Some CMSs and/or frameworks are written so well that you can use them as libraries (or so I've heard).
Using an existing frameworkCMS often seems less scary. But it shouldn't be. It should be horrifying.
Update:
I'm glad you've included some specific features in your question. It will help my answer look a little less like a manifesto and more like a contrarian form of pragmatism.
- Custom menu - There is no question that this will be harder to implement as a module for an existing CMS than it would be if it were simply part of a from-scratch project. An intimate knowledge of the CMS module API will certainly be needed. I'm hopeful, but skeptical that there's a CMS out there that would make this pleasant to integrate.
- User system - This is the perfect example of a really hard problem when trying to interface different systems. It's not that you couldn't create a hack to make it work - I'm more concerned about the long-term maintenance of such a system. Software doesn't have to be monolithic, but if it's going to share responsibilities with other software, there needs to be a clear divide between the two systems. Anything else scares me because of fragility. You'd have to investigate externalizing the entire user system in the CMS - if there's a solid mechanism for doing so, you'll then have to determine the level of effort to implement the "client" side of that communication on your existing user system.
- Third party data - Clearly this is going to be more custom modules and, unless you can find existing modules for the CMS and the third party data sources in question, you're going to have to write them yourself (it sounds to me as if you already know you'd end up writing these yourselves). There's no question it will involve more effort up front to implement these as CMS modules. To be fair, the extra effort may be a blessing down the road as building the modules will require you to properly encapsulate the communication - something you would not be required to do when creating from-scratch sites. (That's what good, old-fashioned discipline is for, right?)
- Multi-site/multi-language - if there's a CMS which already supports this, it may give you an instant leg-up. If there isn't, I can't imagine adding it would require anything less than mucking about in the CMS's internals. Perhaps you could bend an existing feature such as tagging into service to help? (Ah, but here I am trying to shape the problem to the CMS, rather than the other way around. A lesser person than myself might say something pithy like "QED" here.)
There are an additional two parts from your original question which I neglected to address before:
- Security - Yes, a system is only as secure as its weakest link, and that could include shoddily-written modules. Furthermore, more code is more potentially insecure code. Even with a ton of volunteer eyes, an existing CMS is still a whole lot of lines of code you and your team didn't write.
- Server load - I could see this going either way - the CMS may have had quite a bit of work put into this area already (caching, etc.), so you might have an advantage from the outset. On the other hand, if you're running into specific problems, it will be far easier to fix them in your own code than hunting them down in the CMS (and getting them approved and pushed back upstream - and failing that, do you maintain your own fork?).
Updated conclusion
At worst, it would definitely pay to at least look at the existing CMSs as if they were a collection of parts to be sifted through, looking for diamonds. It's likely that no single open-source CMS supports everything you need, but one of them might have a really nice solution for at least part of it. One with, say, an MIT license would allow you to grab a feature you like and use it in a library-like fashion in your own framework.
I think your question is already well-reasoned and full of healthy skepticism. Deciding whether or not to use 3rd party software is super hard. It's like choosing between having a dangerous animal as a pet or being all alone on a solo journey to Mars. You're either going to live with some fear of being eaten, or you're gonna be lonely.