Last tested: June 2021
Public Looks are completely public. In that way, they are not at all secure.
However, the URL is a random hash, which should be unguessable. In that way, they're fairly secure.
You can make your Public Look more secure by setting up IP allowlisting on your Looker instance.