yp sucks. making ypcat exec only by root doesn't solve that problem, not one could a malicious user compile his own ypcat, chances are you are using something like Redhat so all the dolt has to do is grab a RPM...yawn..
there are some things you can do with NIS to make it more secure, however most of the failsafe methods break the purpose and functionality of NIS. For example you can still define local users in the /etc/passwd of all the hosts, however that makes using NIS pointless.
I suggest converting to OpenLDAP. There is redhat documentation regarding this, over at: