I'm running a publicly accessible Odoo instance for years and have never had any security-issues (that I'm aware of). There are in fact thousands of Odoo instances publicly accessible. The whole Odoo cloud for starters. But does that help answer your question? What is your definition of "Safe"?

I know Odoo floated the idea of having an external security audit done some time ago but I don't think that ever materialized. So you have to see it like this: the people that designed the system are pretty smart and aware of how to build a secure system, so it is safe to assume there are no fundamental security flaws in the system. Also they send out notifications of vulnerabilities that get discovered and patched from time to time, so it is something they are actively monitoring.

So without going into "I think" land my conclusion would be that it is "pretty safe", but if you want something super-hardened than this is not it.