This paper analyzes the stochastic security performance of a multiple-input multiple-output (MIMO) integrated sensing and communication (ISAC) system in a downlink scenario. A base station (BS) transmits a multi-functional signal to simultaneously communicate with a user, sense a target angular location, and counteract eavesdropping threats. The system includes a passive single-antenna communication eavesdropper and a multi-antenna sensing eavesdropper attempting to infer the target location. The BS-user and BS-eavesdroppers channels follow Rayleigh fading, while the target azimuth angle is uniformly distributed. To evaluate the performance, we derive exact expressions for the secrecy ergodic rate and the ergodic Cramer-Rao lower bound (CRB) for target localization at both the BS and the sensing eavesdropper. This involves computing the probability density functions (PDFs) of the signal-to-noise ratio (SNR) and CRB, leveraging the central limit theorem for tractability. Numerical results validate our findings.