Totally depends on ICO and differ from case-to-case. I think there is hardly any ico which give you tokens immediately after paying money, yes amount may reflect in account but those are not real tokens but just representative number.
Most of the ICOs give tokens after crowding ends. I strongly feel timing to issue tokens can't be considered the parameter to determine where ICO is legit or not.
smart contracts are designated to do exactly that, you send ETH to them and receive ICO tokens immediately, most of ICO with fixed price ETH/token are behavior like this
example:
https://etherscan.io/tx/0x84a5f531d6e47c8e8e0eaffbf8146c0a537a8e480452ae605e6f6af6a6e2187d0.05 ETH switched to 20 DCORP tokens immediately
then it depends on smart contract setting, if the tokens are locked against move to other wallets etc...
Why do some ICO send you the tokens when you send the ether to the contract and some other ICO e.g. EOS you have to claim it?
Is there a difference on security? Should I trust one of the two better?
if the price is not fixed and the amount of tokens is based on how much will be invested, then it is needed to wait until crowdsale ends to determine amount of tokens you will receive, that's the reason (if it is smart contracts, not apply if ICO has its own system for sale)