Yes, they can be attacked.
There's a reddit thread where this is discussed, including a formula. The thread is 4 months old, so it's possible this has been tweaked in a patch since then.
I've copied over the formula for raid chance and associated notes, with some formatting improvements:
How Settlement raids work:
There are apparently some quests and triggers (I don't have a list of all these triggers) that can force an attack, which will ignore everything I'm about to tell you.
A Settlement will only be attacked if it has at least one population.
A Settlement will not be attacked more than once every seven days.
Every day, there's a chance for your Settlement to be attacked:
Base chance: 2%
Resources add to that: (food + water) / 10 %
(Note that food and water items in your workshop inventory count towards these totals. Thanks to /u/matzman666 for pointing that out.)
Defense and population subtract from that: defense + (population / 2) %
Chance of attack never goes below 2%
Settlement with 50 food + water, 10 defense, and 10 settlers = 2 + 5 - 10 - 5 = -8 => 2% (min value)
Settlement with 200 food + water, 0 defense, and 2 settlers = 2 + 20 - 0 - 1 = 21%
So the chance of attack is always at least 2% per day (unless it's already been attacked in the last week or there are no settlers), but it's not hard to get it that low.