If an Oracle client is used, Toad does not send anything to the server. It communicates only with the Oracle client, and the Oracle client communicates with the Oracle server. The Oracle client (and server) have their own settings for various types of ports and encryption.
Read the "What Are the Oracle Database Built-in Password Protections?" section here in Oracle documentation.
If you want more security, you can use TCPS or SSH, and/or configure Oracle Data Encryption and Integrity. These are supported both with and without an Oracle client. See this post.