What is Minecraft RCON and how to use it safely?

RCON runs a remote console command. So instead of making access public in the same way as the game port, restrict it to the management network.

Step by step

Determine if you really need RCON. If the hosting panel's console is sufficient, drop enable-rcon=false.
If you're going to use it, set rcon.port and the powerful, unique rcon.password. Do not write the password to the public configuration or command history.
Allow RCON port only from trusted management path. Use a private network or SSH tunnel for remote access.
Run a harmless console command with the authorized client. Also test if the port is not accessible from an unauthorized external network.

Don't assume the RCON connection is encrypted by itself. It is a separate management surface from the Minecraft game port.