As secure as pop3 can be. Of course, passwords are sent in clear text, but you will have this regardless of the pop3 daemon you run.
UW-IMAP knows how to do APOP, which sends the password encrypted. The Dovecot author is adding this feature. Not all clients know how to send the APOP command, though.
You can also use secure POP3 (over SSL). Most clients can do this, or you can use a SSL tunnel as a helper app.
