A connection can be secure using asymmetric cryptography, even if somebody observes it from the beginning.
Asymmetric cryptography is a class of cryptographic algorithms which requires two separate keys, one of which is secret and one of which is public.
The public key is used to encrypt plaintext or to verify a digital signature; whereas the private key is used to decrypt ciphertext or to create a digital signature. The term "asymmetric" stems from the use of different keys to perform these opposite functions, each the inverse of the other – as contrasted with conventional ("symmetric") cryptography which relies on the same key to perform both.
So if the attacker steals the public key, he would not be able to decrypt the ciphertext, because he does not have the private key, which no one else should have access to.
As pointed by @Ullrich, you can find more useful informations on How does SSL/TLS work?.
Other nice article: How is it possible that people observing an HTTPS connection being established wouldn't know how to decrypt it?