In sharepoint 2010/2013, I know REST api is automatically security trimmed, but is the JSOM (javascript object model) also security trimmed?
1
Yes, they are both security trimmed, there is no impersonation or elevation of privilege available in these APIs.
1
JSOM (and REST API) runs in the context of the user querying the endpoint or execute the code on the client side. Therefore it is security trimmed.