Setup new Airport Time Capsule to replace old

What are the current Apple recommendations for security settings for am "Apple" network?

Use WPA2 Personal wireless security. A longer, rather than shorter password will provide a bit more security, but devices may take a bit longer to connect to the network initially. Use a random mix of letters and numbers for the password.

More info here.......Recommended settings for Wi-Fi routers and access points - Apple Support

Does using an older Apple extreme (802.11n 1st generation) to extend the network pose a security risk?

No, if you have updated the Time Capsule and AirPort Extreme to use the current version of 7.6.9 firmware.

Installing a new TC to replace the old one I recommend these steps.

1. Export the current configuration.

In the airport utility click the Old TC.. click edit on the summary that pops up.

Go to the top menu and export.

2. Now plug the new TC into the old TC by ethernet.

Click on Other Wi-Fi Devices (1) and the new TC which will start the setup wizard.

3. When you hit the first screen change it to Other Options in bottom left corner.

4. Select replace an existing device.. next.

5. Choose the airport you are replacing.

Everything that can be converted will be.. however some things like MAC addresses.. maybe.. maybe not..

That is why you saved the original. The old TC will also be reset to factory.. and you can now replace the Old TC with New TC.