The Oracle TNS listener, which accepts client connections and hands them to the right database instance. It is the front door to an Oracle installation, and the component clients name when they describe a connection string.
As with any database, keep it off the public internet. The listener itself has a long vulnerability history.
Close it to the internet and reach the database through the application tier. The Oracle listener has its own history of remotely exploitable flaws.
The port scanner will tell you whether 1521 is reachable on a host you control. Checking from outside your own network matters: a port can be open on the machine and still be blocked at the firewall, and it is the view from the internet that decides whether anyone else can reach it.
Only scan hosts you own or have permission to test.