How secure are variable_get and variable_set? I have a custom module that saves variables with FTP usernames and passwords. Is variable_get secure? Ie. Can it be accessed outside of the module.

Is variable_set equally secure?

Obviously they are being saved to the database and are only as secure as the DB but I'm assuming the DB is secure.
I suggest not storing this information with a variable_set or system_settings_form which will put it in the variable store (which is the database by default, and can be cached wherever caching is happening such as memcache).

Instead, I suggest using the $conf array in settings.php for the information. The benefit is that settings.php is a file you are already using to store credentials for the database and already protecting from prying eyes.

The beauty of this system is you can still use variable_get to load the value from $conf which is easy, handy, etc. 

For more details read the settings.php file itself which has a lot of commented out code examples and documentation.