Even if your iPad does not connect to a particular wifi node, it still detects its presence and can read its hardware address. It can use that information to look up its (approximate) location in Apples wifi-node location database.
So yes, even a secure network can be used for location information as the iPad does not need to be connected to the wifi node for location information - it just has to be within range of it as even a secure node can transmits its hardware identifier to any passing wifi receiver. All the iPad needs is that identifier to look up where it is.
However, to receive any location information, you must be passing by some unsecured nodes, as your iPad is somehow receiving the location information from Apple. Do you have "Ask to Join networks" enabled and is it asking to connect at times? Or do you just have a lot of known networks for that area in your list?
Back when Apple still used Skyhook for their location services, I know it also used to cache parts of the wifi node database for your local area. In other words, when your iPad did connect and updated its wifi based location, it would also download and cache the database entries for nearby wifi nodes as well so it could navigate from the cached data without needing a live connection or to at least allow more rapid map updates as you moved around. I don't know how big the "local area" would be in such a case though. Presumably, Apple's own database service does something similar even now.