It’s an NFC card with a secure chip inside that generates a private key at the time it’s created. On the back there’s a QR code with the deposit address. To withdraw the funds, you just need to follow the instructions in the Nunchuk app. Essentially, you enter the spending code on the back and also physically scan the NFC to authorize a transaction. There’s no possible remote attack, but anyone who has access to the card could move the funds. So you need to keep it hidden somewhat, like a seed.