There is obviously some security in place, but it has been breached many times in various different ways. I suppose that, like all real security systems, there are flaws which can be exploited or hacked.
The Doctor talks about how difficult it should be to get inside the TARDIS in the episode The Runaway Bride, which begins with Donna appearing inside the TARDIS. The Doctor's first reaction is:
"This this can't happen! There is no way a human being can lock itself onto the TARDIS and transport itself inside."
The Doctor's surprise seems to stem from the fact a human has done this (although we soon learn that the breach was accidental and not Donna's doing), and also that locking onto The TARDIS is as much a part of the difficulty as actually teleporting inside.
Regarding this "locking on", one notable difference between the arrival of Donna and that of the Kerb!am Man is that the TARDIS appeared to be travelling in space when Donna arrived, whereas the Kerb!am Man arrived while the TARDIS was travelling through the time vortex. However, I don't see that makes much difference - the TARDIS has an exterior presence and an interior which exist in different dimensions (as established in The Robots of Death) and it maintains its relative dimensions as it travels through space and time, and we see that it has a physical presence whilst inside the time vortex. Assuming that whatever is trying to get inside can also travel through the vortex (and we know there are other "cheap and nasty" forms of time travel) it shouldn't be any more difficult to lock on the TARDIS inside the vortex than it is in ordinary space.
The 10th Doctor went on to hypothesise on ways that Donna could have got inside:
"Some sort of subatomic connection? Something in the temporal field? Maybe something pulling you into alignment with the Chronon shell. Maybe something macro mining your DNA within the interior matrix. Maybe a genetic...."
Evidently, it is not beyond the realm of possibility that someone or something could teleport inside the TARDIS if they can lock onto it and circumvent whatever security it has.
As Kerb!am was a clear parody of real-life Amazon, one "in-universe" theory is that, just as Amazon are seeking permission unlock your front door and deliver your packages when you're not home, maybe The Doctor has given Kerb!am pre-authorisation to enter the TARDIS? After all, she had apparently ordered a fez from them. As an analogy, perhaps the TARDIS security is like a firewall - blocking most things as standard, allowing specific things through, but open to circumvention.