I didn't add any products, because its a live site. I looked at the site through Firebug.
The security plugin should be ok. I added security to protect the main site and the admin backend, but as you can see it has many different additional options. I would leave it alone as it is, because now it will be much more harder for anyone to break into the site and it is considered the best security for wordpress.
The W3 Total Cache is not fully set up. That takes time and a finished website. However I turned on some of its features on, and checked through google speed that they were working (and they were). You can optimize the plugin further once you have finished with the products.
You can directly access the shop without the menu. If I were you, I would create a copy of the website on my localhost on my own personal computer where I would test things first before doing it on the live site, so that way you don't make a mistake and anger the client. Install XAMPP if you use Windows7 (google it) on your home computer. I would do all the testing locally (localhost) and only then I'd get it going on the live website.This way there is no guessing.
Site looks good.