They are. Some context might help: when it originally launched, Bitcoin Cash was slower and more unusable than Bitcoin if you needed even a single confirmation, because the forker fucked up the difficulty adjustment algorithm so badly that blocks were every hour or so most of the time. So the Bitcoin Cash community pushed the idea that zero-confirmation transactions were safe there, unlike on the evil SegwitCoin chain, so they could claim it was still faster than Bitcoin since this was the whole selling point. There was no actual foundation for this claim, but it became vital to marketing the coin.

No, they are secure, you just have to trust miners a bit more so they don't throw your transaction out of mempool. I would even argue that all the complications involved in setting up and using Lightning network make it less secure than 0-conf.