How does my Android units get into gmail without IMAP or POP set as active? I just checked and IMAP and POP are shut off, and there is no forwarding enabled.  

So how does my Android have access to all my Google stuff in the first place?

And what is to keep something else from getting in there with the same method?
Google has it's own API that it's clients use to access it's services. IMAP and POP are things Google provides in addition to that custom API, for the benefit of those who use other e-mail clients.

The thing that protects your mail and such is your Google account's username and password. When you give your Android phone your Google account username and password, it's able to use those credentials to access ALL Google services on your behalf.

Thus, once you give the phone your Google uname/pw, it can get to your calendar, mail, play store, etc, etc without you having to give the credentials over and over.