No, actually 2 would also work. It's just that 3 hash functions needs the least space for some reason (less than 2, less than 4 or more).

Well met, and thanks for identifying the solution using overhead.

Insecure? What does that mean in the context of a read-only data structure?

Good point, loose language on my part. I am thinking of false positives or collision. The required statistical properties aren't met.