I haven't looked too closely of late, but my recollection was that the VNC authentication was quite secure -- it's the session itself (screen data transfers, keystrokes, mouse movements, etc..) that have zero security.

Cheers