Is it insecure because XPASS does not require password?

No, the XPASS was designed to be an easy gateway for users to make small payments/purchases. Hence, we always encourage our users to be careful with how they carry/store/manage their XPASS. Do not put significant amount of crypto into the card, as if you would not put a stack of cash into your wallet.