ZigBee is very secure - in general. However, it also depends on how people configure their system as there is a small vulnerability in ZigBee HA which can allow someone to sniff the key when a device is joined (or rejoined). This is generally not possible in ZigBee 3.0, and if your system is configured properly, it’s highly secure.
ZigBee encrypts all data, and uses key counters to avoid reply attacks. You can’t use such a simple hack to attack a ZigBee network, and with correct configuration, ZigBee is as secure as any system available.