Is Steams's Voice Over IP Secure in 2018?

If you accept a voice chat call over Steam, you will connect directly to their computer for the voice chat, and not through Steam's servers. That means, unlike Discord or a small handful of other platforms, if the other person is running any kind of network analysis tool, they can trivially obtain your IP address.

That said, what someone can do with your IP is rather limited. With rare exceptions, they cannot determine your location beyond a ballpark estimate (within ~50 miles usually). They can't find your real name from it either unless they work for the company who services your internet connection. The only practical use for griefers/scammers like you pictured is to attempt to launch a DDoS (very illegal) to disconnect you from the internet - common for streamers and high ranking competitive players - and hope you don't know how to change it. So yes he probably has it, but I wouldn't worry much. He's just trying to scare you.