The command channel for FTP: login, directory listings, and instructions to transfer files. Still widely deployed on shared hosting despite its age.
Plain text, including the password. An exposed FTP port is one of the most reliably attacked services on the internet, and brute-force attempts against it are constant.
Worth knowing. If you need FTP-like access, SFTP over SSH gives you the same workflow encrypted, on port 22, with no second data connection to configure.
An open 21 on a public host should be treated as something to migrate off rather than to harden. Check the logs first: you will almost certainly find continuous login attempts, and if any succeeded, assume the credentials are compromised.
The port scanner will tell you whether 21 is reachable on a host you control. Checking from outside your own network matters: a port can be open on the machine and still be blocked at the firewall, and it is the view from the internet that decides whether anyone else can reach it.
Only scan hosts you own or have permission to test.