..and they refuse to change password (last time checked about a year ago) for my 6 digit id. That's secure.

Current owner of the messenger has always had open door policy for russian law enforcement organizations, so any changes since 2010 couldn't be counted as secure.

edit: Also, the recently published analysis of the data on available in-the-wild (authentication isn't supported! firewall rules were deleted due to requests for it of the end users! some of the data is on shodan.io!!!) mandatory for ISPs traffic tampers made "to help russian police with investigations" showed that it has client's IP - ICQ UIN mapping.