I am afraid your search for Annals of Stats etc. level of purely statistical theoretical papers in cryptology may not yield too many examples.
The field is very applied and the role of statistics is usually of the form, if this source (usually key generator) is i.i.d., uniform then such and such property holds.It is not very natural to model (other than ideal OTP) cryptosystems this way.
However, the IEEE Transactions on Information Theory does publish theoretical papers on cryptology with a probabilistic flavour.
I have some suggestions of papers to look at below:
N. Merhav and E. Arikan, "The Shannon cipher system with a guessing wiretapper", IEEE Trans. Inform. Theory, vol. 45, pp. 1860-1866, Sept. 1999.
X. Lai, J.L. Massey and S. Murphy, "Markov Ciphers and Differential Cryptanalysis", EUROCRYPT'91.
and here is one I found by searching for citations to Diaconis' work
Kulis, Lorek and Zagorski, "Randomized stopping times and provably secure pseudorandom permutation generators" available at https://eprint.iacr.org/2016/1049.pdf
Historical Anecdote: For both of Shannon's groundbreaking initial papers, A Mathematical Theory of Cryptography and A Mathematical Theory of Communication
(see https://evervault.com/papers/shannon ) for a PDF of the first, there was some criticism from pure probabilists and statisticians that the papers were not rigorous enough. Shannon was of course a towering figure of 20th century science who together with Turing enabled most of modern data communications, but these criticisms based on rigour were mostly ill-founded. Shannon was focused on applications rather than generalizing the theory to arbitrary channels. And he also obtained the zero error capacity of the pentagon graph $C_5$ which has barely been improved in the 60 years since, even though the top combinatorialists and probabilists of the Hungarian school worked on it.
For example, J. Wolfowitz re-wrote Shannon's approach to information theory using the full epsilon-delta approach and measure theory. But he was rude enough to suggest that Shannon's work was inferior, which I'm sure Shannon didn't care about but others were offended on his behalf.
Other generalizations of Shannon's work were also obtained later on but Shannon had started the field and shown the direction as well as establishing such performance measures as channel capacity, perfect secrecy, confusion and diffusion. Some of these measures are hard to define precisely in full generality but this is part of their power.