It was possible in the past, and it is possible today. Currently, there is no chain I know of, which can trace block headers from other chains, and use that information, to properly calculate the global difficulty. Which means, that if testnet has a small fraction of mainnet hashrate (for example 1%, or even less than that), then any mining pool, at any time, can launch 51% attack, given enough incentive. It was done in the past on many altcoins, and it can be done on testnet, too, if test coins will be too valuable.

Testnet was never secure. As long as the difficulty is forced to drop to the minimal value, when nothing is mined for 20 minutes, it is a flaw, which is constantly abused. And recently it turned out, that even signet is somewhat insecure, because it has even lower difficulty, and signet nodes can be flooded with valid blocks, when miners will tweak nonces from the original blocks, produced by signet creators (see: fork.observer at block height 243473).

In general, the problem of making a good test network is still unsolved.