Yes this is AT over TCP/IP , i don't know anything about the security concerns though.
The question about the router depends on where the router is. If the client Mac is behind a router it should work ok, but if the server is behind a router you would have to enable inbound mapping on the router to reach the server.
you can tunnel AFP over ssh to make it (more) secure. That's what i do when i need to acces my home computer from work. Go to the terminal and type:
ssh yourname@your_ip_addres -L 5480:127.0.0.1:548
now type your password. Now you have a secure tunnel. Do command-k
and connect to afp://127.0.0.1:5480
you now have acces to your home machine!
you need to be sure you have Remote Logine enabled(Sharing control panel) and that your home machine is not behind a nat/firewall (in which case it's still possible but a different story)