Non-orthogonal multiple access (NOMA) and ambient backscatter communication have been envisioned as two promising technologies for the Internet-of-things due to their high spectral efficiency and energy efficiency. Motivated by this fact, we consider an ambient backscatter NOMA system in the presence of a malicious eavesdropper. Under some realistic assumptions of residual hardware impairments (RHIs), channel estimation errors (CEEs) and imperfect successive interference cancellation (ipSIC), we investigate the physical layer security (PLS) of the ambient backscatter NOMA systems focusing on reliability and security. In order to further improve the security of the considered system, an artificial noise scheme is proposed where the radio frequency (RF) source acts as a jammer that transmits interference signal to the legitimate receivers and eavesdropper. On this basis, the analytical expressions for the outage probability (OP) and the intercept probability (IP) are derived. To gain more insights, the asymptotic analysis and diversity orders for the OP in the high signal-to-noise ratio (SNR) regime are carried out, and the asymptotic behaviors of the IP in the high main-to-eavesdropper ratio (MER) region are explored as well. Numerical results show that: 1) RHIs, CEEs and ipSIC have negative effects on the OP but positive effects on the IP; 2) Compared with CEEs, RHIs have a more serious impact on the reliability and security of the considered system; 3) There exists a trade-off between reliability and security, and this trade-off can be optimized by reducing the power coefficient of the artificial noise or increasing the interfering factor of readers; 4) There are error floors for the OP due to the CEEs and the reflection coefficient; 5) As MER grows large, the security for Rnand Rf is improved, while the security for T is reduced.