Yes, this is secure provided the message to be signed is unique on each login to prevent replay attacks. Usually that's done with either a random challenge or the signature over a shared secret.
In fact, SSH does this already with ECDSA keys: the two sides agree on a shared secret, which is hashed, and the client signs the hashed secret and some other data to verify that it's allowed to log in. MariaDB also does a similar thing by deriving an Ed25519 key (which isn't exactly ECDSA, but is similar) and using that to sign a random challenge (although it doesn't necessarily derive this key in a secure way).
Similarly, most FIDO2 and WebAuthn two-factor authentication devices, such as YubiKeys, use this approach. You could also use TLS client certs that are ECDSA, which is another approach used in some environments.
This could be used for any type of login, including websites, but it is less common there because people don't expect to carry a key around with them everywhere and frequently log into websites from different computers, so it's practically inconvenient. But ignoring the practical problems, this is secure if implemented correctly.