OTPs are secure because they are unique for each session, reducing the risk of replay attacks.