Having the word "echo" in the URL is only a security problem if you write terrible PHP that executes whatever's in the URL.
If your host won't turn off mod security (or at least turn off that option) you could remove the word "echo" from every question title (I assume that's where it's coming from). You'll need an event plugin that runs on q_post and q_edit which removes "echo" then re-saves the post.
