An FTP server is perfectly fine for anonymous logins, assuming it was configured server side to be running as a low permissioned user.

But yes, once you start taking user credentials, you need to move to something like FTPS or SFTP (urgh... double standards).