WebDAV is an extension to HTTP, so it works pretty much like a normal webserver with security being the same. The only downside to WebDAV as Duplicati uses it, is that the list of files is returned in XML which is quite verbose, and thus can take a while to get for a directory with many files.
In a more paranoid way, having a webserver that is also write-able requires some attention to the setup. At least if parts of the webserver is publicly accessible.