Encrypted IMAP — mail reading over TLS, established before any credentials are sent. It is what every mail client should use, and what the setup wizard picks by default when you type an email address into a phone.
Sound by default. The remaining risks are weak passwords and absent multi-factor authentication rather than the protocol.
Open 993 is the correct configuration for IMAP. The remaining work is password policy and multi-factor authentication rather than anything about the port itself.
The port scanner will tell you whether 993 is reachable on a host you control. Checking from outside your own network matters: a port can be open on the machine and still be blocked at the firewall, and it is the view from the internet that decides whether anyone else can reach it.
Only scan hosts you own or have permission to test.