I'll start with your second question, "do contributed modules make Drupal less secure?"
In general, yes, because contributed modules expand the attack surface of your site. When a module provides user interaction features it's another point an attacker could probe for exploits on your site. Additionally that module becomes another dependency in your system and that affects site maintenance and agility.
Now, not all contributed modules are the same, they don't all provide user-facing functionality, but the point is that most every additional module has to be balanced with the possible risks that come along, including possible vulnerabilities.
Also, Gareth Parker correctly highlights that contributed modules undergo far less peer-review and testing than Drupal core, so there could be greater likelihood of security risks in the code. Again, it depends on the modules.
As for your first and main question, "is Drupal secure?". As one of the authors of the Drupal Security Report which attempts to answer this question by analyzing Drupal's published Security Advisories as well as describing how Drupal addresses the OWASP Top 10, I would say "yes" :) Full disclosure, I'm also a member of the Drupal security team.
However, there will be vulnerabilities found in Drupal in the future, it's not secure in that it's immune to risk. It's secure in that it's been both professionally reviewed by security firms and peer-reviewed by thousands of contributors during its development. Additionally, core APIs are strong, providing security mitigation techniques and tools, and many of the default configurations are secure.