An important difference is that in ethereum accounts and data exist as ordered data in a state database. Transactions modify this states.
In bitcoin though, the consumption of old UTXOs and the creation of new UTXOs leads to the change of an implicit state. One could say that all the unspent transaction outputs together reflect the current state in bitcoin.
Example:
In Ethereum you can directly search for an address in the stateDB and query the balance.
In Bitcoin you have to search every UTXO and look whether you can formulate the spending condition. Summing the values coupled to the UTXOs gives your balance.
Bitcoin and Ethereum share (roughly) the same security. In Ethereum you have to sign your transaction using ECDSA on curve Secp256k1 to transfer balance or invoke a smart contract which handles state changes. Every state changes begin with a signed transaction in Ethereum. In Bitcoin, you can formulate spending conditions which require no EC signature. For example, you could formulate the condition "x + 2 = 3" to protect an utxo from being spent. Anybody who has the arithmetic skills to solve that equation can take this UTXO, formulate the solution (push 1 on the stack) and create a valid transaction (and therefore implicitly transfer value).
There is a big difference in the languages used in smart contracts or in bitcoin scripts. The former languages are (usually) turing-complete, which (roughly) means that you can solve every problem a computer can solve with that language. To be exact, they are quasi-turing-complete, because there is another factor which limits what the language can solve: Gas cost (execution cost) and gas limits.
Bitcoin uses a turing-incomplete language. Important operations got removed from that language and only what is really necessary was left. Further Bitcoin client rules often limit the script sizes dramatically. These circumstances limit you extremely in the creation of "smart contracts" in Bitcoin.
The fact that you can formulate any program that a computer can execute in ethereum, makes the language extremely powerful and therefore dangerous. Writing smart contract requires a lot of thoughts about how you write your code that it can not be exploited. Cases occurred where people intentionally wrote code that they could abuse it later to cheat their customers. To name some examples where code bugs lead to high damage: DAO Hack, Partiy Multisig bug, integer overflow attacks
Both bitcoin addresses and ethereum address are checksummed, so human typing errors are catched. Bitcoin addresses have a stronger checksum though.