Your notes are (or at least were 4 years ago when I last used it) stored in plaintext on your gmail under the notes tag. You don’t hear negative stuff about it because 99% of people don’t use notes for sensitive info, or even things they care about. It is also not a high profile app like messaging apps. It is just something everyone assumes is completely fine.