Android App Cache Security
The "cache" of an app is just a directory inside that app's data directory in /data/data, so there are no special security implications compared with the app's general data. The cache directory has the same permissions as the data directory enclosing it: no other apps can access it, and the user can't access it directly (via adb or a PC), unless the phone is rooted (or the app itself exposes access).

From an OS point of view, the only difference between an app's "data" and its "cache" is that there's an extra button to clear the cache, with the expectation that no user data will be lost that way. They're both treated the same way by the OS, and it's entirely up to the app what data to store in each.