Native Android app with Drupal backend and Login
You didn't mention your version of Drupal, and I cannot speak for D8. But D7 has the Services module, and this provides all the functionality you will need. We use the Oauth2 module (that ties in with Services) to provide the authentication mechanism for the apps we build. With this, the user will first log in with their credentials, from which they will receive an authentication token. This token is then used for all further communication between the app and the server.

The Services module is highly customizable, and can be used to code your own resoures that can be called through the API from the app. You can choose the output format, of which JSON is one option. 

Shawn answered your questions regarding protection of the user's credentials. This is the same as with a browser - use HTTPS (SSL certificate) and the credentials will be protected. If you don't use HTTPS, the credentials will be there for anyone who looks.