ewarn "$(<${FILESDIR}/README.security)" You can't access FILESDIR in pkg_postinst(). This doesn't work for binary packages, and may be rejected by Portage altogether soonish. Look at how readme.gentoo* eclass solves it.
Fixed: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=14d049f4480fd2a1b49bc9e60a00f3ae39e29424