The "insecurity" in IMAP mostly comes from password based authentication. The client application needs to know cleartext account password to use it and the same password, if leaked, can usually be used to manage the account. While browser based applications are pretty good already for blocking unintended usage, showing captchas to block bots etc, then it is way harder to do the same on the IMAP server side.

So in general it comes down to configuration. IMAP per se is not insecure. How you use it though, might be.

If you are concerned about someone reading your emails in transit, make sure you use TLS. IMAP is standard; as far as I know, almost everything uses it.

Any references for where you've heard this? Then we can check the claims and perhaps reassure you or suggest workarounds. What are you using instead?

IMAP is on its own insecure because it is a plain protocol, but it can be used in conjunction with TLS to add secure transport. Exactly the same can be said for many other mail protocols such as POP3.