Thin: it doesn't download the blockchain. It connect to a server and ask to it info about it.

It's secure cause it work like a normal client, it have it's wallet and the private keys and simply ask to the server info about the blocks and how many btc do your wallet have.

The wallet stay on your computer, the server NEVER see it, never require the private keys.