Yes, hybrid apps are secure, but it usually depends on how they are hosted and coded. They are secure by design if correctly coded.  Security vulnerabilities can be easily identified using free tools such as JFrog, but such flaws can be found not only in hybrid apps but also in native apps.