TL;DR: While two qubits must be transmitted in total, in the instant where two bits are to be communicated, only one qubit has to be sent. The information being sent is masked, but it is not truly secure.
There are two distinct phases to a superdense coding protocol. In phase 1,
Alice and Bob prepare a Bell state $(|00\rangle+|11\rangle)/\sqrt{2}$. This is a two-qubit state and Alice holds one qubit, and Bob the other.
Alice and Bob travel off to distant locations, each taking their qubit. We assume that there are no errors; the quantum state does not change over time.
This has all happened in advance, long before Alice knows what message she wants to send to Bob. The second phase occurs later, when Alice decides what two bit message she wants to send to Bob.
Depending on the message she wishes to send (she has 4 possible options), Alice applies either $\mathbb{I},X, Z$ or $Y$ on her qubit.
Alice sends her qubit to Bob.
When Bob receives Alice's qubit, he brings the two qubits together and measures in the Bell basis. Each of the four different possible measurement outcomes correspond to one of the 4 messages Alice had to choose from.
So, overall, you are correct that two qubits have to be sent. However, one of these qubits can be provided to Bob in advance, long before the communication, and before the content of the message was decided. Thus, in the instant when you want to send two bits of information (phase 2), you only have to send one qubit (the one that Alice has). Its like if you know you have lots of deadlines all due on the same day. You don't leave doing each of those jobs until absolutely the last minute, even if there are some last minute adjustments that you have to make on each. You work on things in advance so that, when that last minute information is available, you have to do the minimum possible.
This is the idea behind superdense coding, and it illustrates one of the principles of quantum information: you can provide some resource at an earlier time, independent of what is going to be done later and that resource can be consumed to achieve a more efficient result in the instant.
If you're interested in security, then for the protocol as described above, an eavesdropper can only get access to the qubit that Alice sends to Bob. In that case, the eavesdropper cannot tell what information Alice was sending to Bob (the density matrix of that qubit is $\mathbb{I}/2$ no matter what Alice did to it to encode the message). However, the eavesdropper can scramble the message by applying a Pauli operation on that qubit. The eavesdropper won't know what message Bob will receive (because it will be a combination of what Alice and the eavesdropper did), but Bob won't receive what Alice intended.
If it is the case that Alice prepares both qubits and sends them to Bob (just at different times), so that an eavesdropper could intercept thefirst qubit as well, then the protocol is completely insecure as the eavesdropper can just replace Bob. There is no authentication of the receiver.
What does it mean to "prepare a quantum state"?
Every quantum state of a particular dimension, $d$ has an associated quantum state. This quantum state can be described mathematically as a $d$-dimensional complex vector. As theorists, when we say "prepare a quantum state", we mean that we specify a vector that we want that quantum system to be in.
In practice, how is this done? You first measure your quantum system to find out what state it's in already, and perform a unitary operation to convert it from what it is to what you want it to be.