Every cross-chain message passing system is going to have trade-offs, and we've carefully considered how security is affected with design choices. Nomad adopts an optimistic mechanism inspired by optimistic roll-ups like Optimism and Arbitrum, which is a different approach than block header verification, or native verification. Check out the section on verification mechanisms to read more about the various designs and their trade-offs.
Nomad does not have a token at this time. If you hear any references to a Nomad token, they are definitely scams.