The "insecurity" in IMAP mostly comes from password based authentication. The client application needs to know cleartext account password to use it and the same

The "insecurity" in IMAP mostly comes from password based authentication. The client application needs to know cleartext account password to use it and the same password, if leaked, can usually be used to manage the account. While browser based applications are pretty good already for blocking unintended usage, showing captchas to block bots etc, then it is way harder to do the same on the IMAP server side. So in general it comes down to configuration. IMAP per se is not insecure. How you use it though, might be.