The ongoing integration of renewable generation and distributed energy resources introduces new challenges to distribution grid operation. Due to the increasing volatility and uncertainty, distribution system operators are seeking concepts to enable more active management and control. Flexibility markets offer a platform for economically efficient trading of electricity flexibility between distribution system operators and other participants. The integration of cyber, physical and market domains of multiple participants makes flexibility markets a system of cyber-physical systems. While cross-domain integration sets the foundation for efficient deployment of flexibility, it introduces new physical and cyber vulnerabilities to participants. This work provides a systematic overview of threat scenarios for the cyber-physical systems of flexibility markets. Results reveal several remaining security challenges across all domains, that require more attention. Based on the threat scenarios and a novel generic monitoring requirements model, monitoring concepts for secure participation of distribution system operators in flexibility markets are proposed. By highlighting approaches to tackle identified challenges, this work provides new directions for further investigations, and takes important steps towards secure implementation of flexibility markets.