Is saving passwords safe?

iCloud uses a minimum of 128-bit AES encryption—the same level of security employed by major financial institutions—and never provides encryption keys to any third parties.

The iCloud Keychain portion of iCloud actually uses 256-bit AES encryption.

iCloud: iCloud security and privacy overview

Then it is as safe as anything else on your phone.

Do you use a passcode?

If someone has access to an unlocked phone then they would have access to anything on it.

Just like if someone had access to your unlocked car, they would then have access to anything inside it.