I doubt it's much different than Perl. Both languages have very loose type systems. In fact the internal implementations are rather similar since both use strings but optimize numbers (IVs etc in Perl which are visible to the programmer, in Tcl the bytecode interpreter optimizes ints/floats to an internal representation but at the language level everything still looks like a string).

Perl's tainting feature is the only security-related advantage over Tcl that I can think of right now, but it's not used unless you explicitly enable it.

No, that doesn't make it any less secure security-wise. It's probably because Tcl isn't an ALGOL type of language. I love Tcl by the way and I wish it was used more than it is.