Website that sells statistics

Well to say that these custom fields are insecure in the wp core tables is to say that the usernames and passwords are also insecure, along with any private or password protected posts.

As long as you are not outputting these custom fields anywhere but a secure page for logged in, paid up users, no one could retrieve them without server side access to run a custom query.

Of course you should try to be security conscious when writing code for your site, by using data sanitisation and security methods such as nonces.