It seems BAQs can't access any data from the Security table, but a data dump or method directive or ODBC connection will be able to. Join Menu.SecCode to Security.SecCode.
Mind that you'll only get what the security is on a particular item, i.e. who has access provided they're able to access the parent menu. To get a picture of what menus a person has access to, you have to look at the security on all the parent menus too. Security's not cumulative, it considers each individual item's security as it goes down the hierarchy. It's easier to output the security at each level and let the reader decide whether a user ultimately has access to a menu (which helps with spotting gaps in security), though it should be in the same order as the Epicor main menu to be useful (a recursive query will make that easier, which SQL Server and Epicor 10 can do).
My approach was a macro-enabled Excel workbook that grabbed a few tables from a data dump, then evaluated the security for each item and wrote out a new worksheet with a menu for each row and user for each column, with each cell indicating whether they had access by security group or individual user or All. I'm sure there's several ways to do a report like that, but having the menus in hierarchical order is particularly important.