It gets a bit more complicated with Bitcoin, as I believe you should offer both SegWit and legacy addresses.
You don't need to 'offer' a legacy address to receive donations anymore.
Any halfway up-to-date wallet can send to bech32 addresses.
Using a single segwit address should be enough. And if you still believe some user might use wallets which are incompatible to bech32 (which would be way too old wallets), simply use a nested segwit which is accepted by each wallet.
How much extra security do you think using fresh addresses will give you, and do you think it is worth the inconvenience resulting from not using a single address.
No practical extra security at all.
You can receive transactions as often as you want to the same address.
When you send some BTC from the addresses, you public key / redeem script will be published. That's it.
This doesn't affect the security in a noticeable way.
With bitcoin, you can use the same address as long as you want with as many transaction as you wish.
The only thing you are compromising with it, is your privacy.
But if you don't care whether people know how often and how much you get in donations, feel free to use a single address for the rest of your life.
Security-wise, this is absolutely fine.