If I create a K2 Item and set its access level to Registered or even stricter, and I attach a file to this item, how secure is the attachment? Will Google index the attachment? Can an unregistered user download the attachment if they are given the direct link to it?

Well I was playing around with it and it does NOT seem secure at all.

I created an item and added an attachment. I copied the URL to the attachment. I then set the item to Registered users. Now when I try to load the item, it correctly requires me to sign in. HOWEVER if I directly access the URL to the attachment, I am able to download the attachment without signing in!!

If you plan to restrict the access of attachments to a specific user type, then you need to think about using document manager such as DOCman or jDownloads for example.