They have value types. The expressions don’t have types (or rather very general types), but the values do, and it’s still possible to have a dynamic language with very rigorous value types that have a well-defined set of inhabitants.

Any dynamic language that has a string type has something similar to (for example) a buffer and a length associated with it internally. You can formalize that from the compiler’s perspective, even if you don’t expose it to the outside.

You could argue that the language doesn’t necessarily have memory safety associated with its types, because a compliant compiler or interpreter could represent strings in any way it chooses, and on some academic level there’s merit to that, but in practice you’d be rather stupid to implement the string value type in an interpreter or compiler for a language with a common string type in a memory unsafe way.

At least theoretically one could have a dynamic language with e.g. C-style malloc/free manual memory management, although I haven't actually seen such a thing in practice.