Apple Remote disable unencrypted access

VNC Viewer would have to support that.

What are the source and destination systems? For example Mac, Windows, Linux, Solaris, AIX, HP-UX, etc...

If a Windows system, maybe try RealVNC client. It might know about Apple's secure connections.

Or you could start an ssh session with a VNC tunnel. That would give you a secure channel

ssh -L 25900:127.0.0.1:5900 username@remote.system

Start your VNC Viewer connection with the destination being 127.0.0.1:25900

Or it could be localhost:25900

If it is Mac to Mac, then use Back-to-My-Mac (see System Preferences -> iCloud -> Back to My Mac). Both Macs must be using the same Apple ID to login to iCloud

Back-to-My-Mac will encrypted everything. Whether it is Screen Sharing or File Sharing.

You do NOT need to use Apple Remote Desktop. You can use Screen Sharing, which is included with your Macs, unless of course you are using ARD to do remote admin things (which MrHoffman has much more experience with).

If you use a generic VNC client, it may or may not encrypt anything. Typically generic VNC does not encrypt anything. Neither the username/password exchange, nor the traffic sent back and forth.

MrHoffman's VPN suggestion if you are going across the internet is one secure solution. Back-to-My-Mac should be another. The ssh tunneling suggestion is another, but it has a lot of setup work needed with routers and things like dynamic DNS names, not to mention getting the ssh command line correct. However, I do use it all the time for my remote VNC operations (after spending months figuring it out back in the '90's).

If you're exposing VNC/RDP/ARD to the 'net, that's... not what I'd do. I'd use a VPN into the firewall and a firewall with an embedded VPN server, and connect via VNC/RDP/ARD via the VPN. I'd not expose an open TCP port 5900 to the 'net. Exposing it internally? I'd firewall the server into a DMZ if the server is externally exposed and would restrict and isolate the server contents and access, but whether or not the internal network can access the server in the DMZ via VNC/RDP/ARD directly or via VPN, that's your call.

I'm guessing that the audit here probably involved a port scan performed on the external network, and was not an internal port scan.