Investigate: is it a problem that our mailserver allows "Connection security: None" for IMAP and SMTP?

[jfly]

When I add a new account via Thunderbird, autodiscovery doesn't work, but once I manually configure the IMAP and SMTP hostnames, then Thunderbird autodiscovers this distressing configuration:

Things do work if I explicitly select "SSL/TLS" for both:

Are the "None" settings as insecure as they sound? Can we disallow this?