How safe is it to use cloud proxy for connection between VM and Paas instance in Google cloud

If you use a PaaS-based client application, most likely it has an ephemeral IP address. In this situation, restricting access based on the range of source IP addresses may be ineffective.

In such a case using Cloud SQL Proxy is optimal. As with many services that use public IP address, Google Cloud Proxy protects traffic in public networks by encryption. Traffic between the proxy client and the proxy server process is passed through the secure tunnel encrypted using AES cipher.

Apart from that, The SQL Proxy requires authentication and uses IAM to restrict access to the SQL instance.

You can find more information in the documentation:

Cloud SQL > Doc > MySQL > Connecting to Cloud SQL from external applications

Cloud SQL > Doc > MySQL > About the Cloud SQL Proxy:

The Cloud SQL Proxy provides secure access to your instances without the need for authorized networks or for configuring SSL. The proxy automatically encrypts traffic to and from the database using TLS 1.2 with a 128-bit AES cipher; SSL certificates are used to verify client and server identities.
The proxy uses a secure tunnel to communicate with its companion process running on the SQL server.
The proxy requires authentication. When you use a service account to provide the credentials for the proxy, you must create it with sufficient permissions: a role that includes the cloudsql.instances.connect permission.

Cloud SQL > Doc > MySQL > Connecting from App Engine standard environment to Cloud SQL:

App Engine provides a mechanism that connects using the Cloud SQL Proxy.
Once correctly configured, you can connect your service to your Cloud SQL instance's unix domain socket using the format: /cloudsql/INSTANCE_CONNECTION_NAME.
These connections are automatically encrypted without any additional configuration.

Also, you may configure your systems so that use Private IP as described here:

Cloud SQL > Doc > MySQL > Private IP