The main entry point for SecurityStateModel is the GetSecurityInfo() method. This method is called quite frequently, including every time the omnibox redraws. To avoid unnecessary work, SecurityStateModel::GetSecurityInfo() memoizes based on a VisibleSecurityState provided by the SecurityStateModel's client. (The VisibleSecurityState contains any data that might affect security UI, such as the certificate, the connection status, mixed content status, etc.)

I think we should remove the memoization and VisibleSecurityState. It memoization doesn't really save us much work: when GetSecurityInfo() recomputes the security info, it's mostly just copying data from the VisibleSecurityState to the SecurityInfo. It does a little bit of computation -- mostly in GetSHA1DeprecationStatus() -- but I'm skeptical that the memoization actually gives any measurable performance improvement.

It's conceivable that in future we might want SecurityInfo to contain something that is expensive to compute and that is needed by devtools or WebsiteSettings but not by the omnibox, in which case it really would be detrimental to re-compute it every time we redraw the omnibox. I imagine that, in such a future, we could add the new computation as a method on GetSecurityInfo(), or as a separate SSM method, so that it's computed only when UI needs it.

(The reason I want to remove the memoization is basically simplicity: the SecurityStateModel interface is pretty ugly, and adding new data to SSM is a tedious matter of copying it from one object to another about 4 different times.)