Performance
Only the amount of resources interefere. The additional work that Apache will do is negligible in my experience. I've never seen a benchmark really evaluating this.
What will happen is that Apache simply has to go through a list (or any other structure) to identify which vhost belongs to the request, and then the process continues normally.
Security
The site in vhost will influence much more security than the vhost feature. For example, if your site hosted on a vhost has a route that downloads a file, and the parameters in this script are not properly validated, you might be able to download a file from another site. But this, as you can see, is not a failure of the vhost structure, but rather a failure of your site hosted on vhost.
The only problem with having multiple vhosts on the same server is that the digital certificate must be unique for all sites, which can be a problem. This limitation is not due to vhost, but to the fact that the SSL / TLS handshake occurs before the HTTP request is sent, and therefore there is no way to define which certificate to use: the same certificate is always used. But this limitation does not occur simply by vhost, but by the fact that the two sites use the same port for connection. Therefore, if you configure each vhost to work on a different port, this limitation will be bypassed.