In 2013, I visited the National Cryptologic Museum and researched/photographed the donated materials on the Chaocipher from the Byrne family. As it pertains to your question regarding the security of the cipher, it is true that while the original algorithm has been now been known for several years, to date no known cipher-text only decryption has yet been accomplished or announced.
One discovery I made in the museum was an early draft of Kruh and Deavour's 1990 Cryptologia challenge article on the Chaocipher. While their published "Exhibit 5" in Cryptologia also went unsolved for 23 years (until, during my visit, I found their solution), this earlier draft (now christened "Exhibit 6") still has not been solved and poses a true challenge for the modern cryptanalyst looking to test their skills against the Chaocipher.
In Exhibit 6, you will find 50 short lines enciphered 'in depth'; the actual encipherment algorithm is not Byrne's classic alogorithm, nor has it proven to be the advanced variant that K&D used for their published "Exhibit 5". No plaintext is provided (unlike Byrne's own Exhibits 1-4), no source for the plaintext has been given (unlike K&D's Exhibit 5). The cryptanalyst who might solve this challenge (published in Cryptologia 2014, Vol 38 Issue 1) would be the first on record to have 'cracked' a Chaocipher encipherment.
A cursory overview of Exhibit 6 may be found here: http://www.chaocipher.com/chaocipher-024.htm. Additional information on the various classic and advanced algorithms noted may also be found at www.chaocipher.com.
After 5 years of Chaocipher research, I believe the cipher remains far stronger than many would believe. Relative to modern computer-based ciphers, it is indeed 'simple'... but 'simple' is relative, and until proven otherwise - as demonstrated by a full solution for a ciphertext only encipherment - it continues to stand as an early example of what, today, we would call 'dynamic substitution', its incredible number of left/right alphabet permutations of 26!x26! defying both modern-day brute-force attack capabilities and, so far, any other decryption efforts.