Is standard RADIUS safe enough to use?

For EAP-TLS, yes, with two conditions. The credentials that matter — the certificate and the keys derived from it — are exchanged inside the TLS handshake that EAP-TLS carries, so they are not readable by somebody watching the RADIUS packets. What is readable is the surrounding metadata: which device asked, which access point or switch it came through, and the outcome.

The two conditions are the shared secret and the path. Treat the secret like a password — it is generated for you, it is long, and it should not be reused between sites or pasted into a ticket. And prefer a path you control end to end where you can.

Passbeam refuses requests from any source address that has not been registered for a site, before doing any cryptography at all, so a scan from the internet costs nothing and is turned away as an unknown source. But the honest summary is that RADSec is the better transport and standard RADIUS exists because wired switches leave no choice.