You’re spot on. Most of the cables are either laid on the sea floor and up to a beach, or buried underneath beaches. The following link has some good background on what goes into laying cables and how they terminate.
As for physical security, there isn’t much on the sea floor. There are various instances of nation states tapping cables due to the ease of access when it comes to actually “listening” to the data. Obviously the issue there is getting to the undersea cable.