Like many data storing daemons with predictable filenames, apt-cacher-ng is vulnerable to symlink attacks and similar malicious actions. Therefore, the user must make sure that the cache and log directories are writable only to the user account under which apt-cacher-ng is running.
As to the program's internal security, apt-cacher-ng has been developed with concern about a certain level of attacks from internal users as well as from malicious external hosts. However, no guarantees can be made about the security of the program. It's recommended to run apt-cacher-ng under a system account which has no access to any system files outside of the cache and log directories. Refer to the manuals of the administration utilities of your distribution (like start-stop-daemon) to create the required configuration.
If relaxed permissions are required, e.g. to make files group-writeable, this can be established through the appropriate use of umask command in the startup scripts of apt-cacher-ng (see /etc/default/apt-cacher-ng, for example) and the sticky bit on the cache directories (see chmod(1) manpage for details).