Secure webmail access over HTTPS is in theory just as strong as IMAP access can be made to be. Of course, by using untrusted hardware you are exposing yourself

Secure webmail access over HTTPS is in theory just as strong as IMAP access can be made to be. Of course, by using untrusted hardware you are exposing yourself to various circumventions of the security protocols, but that's just as true of IMAP as it is of HTTPS. In fact, IMAP is probably slightly worse since it does actually download messages to the local machine by default, where they must be explicitly cleaned up.