They're secure so long as you have them, but if you lose them, there's nothing to authenticate that the person using it is the person who's supposed to be using it, which there is with PINs and, to a certain extent, with the numbers on the back of card. There's none whatsoever for tap.
On April 3rd, 2019. See this statement in context.