If I have a subdomain, and I set my cookie's scope to be
/ instead of
examp.example.com. How can it be insecure?
You're talking about two different scoping properties.
examp.example.com is a domain scope, and
/ is a path scope.
/ means that the cookie is valid for any URL path within the relevant domain scope.
examp.example.com is that relevant domain scope.
To answer the question in your comment, yes, you want to specifically scope your cookies to your sub-domain to prevent them from being sent along with requests to other sub-domains, where they could be read by those who have no business reading them. So you do not want to scope cookies that are specifically for
.example.com, or rely on any cookies that are scoped to