Our "resolution" to this dilemma ... (Exch 2003, Outlook 2003):
1- ActiveSync is widely used here. We have a bunch of iPhone users (including myself), and a number of other smartphones.
2- For company laptops we setup Outlook in "cached mode", and it connects to Exchange when the PC is connected to the network via VPN. When not connected, they can still work in offline mode.
3- We do not allow home (i.e. non-company) PCs to connect to the network or to connect Outlook to Exchange. If we haven't given you a laptop, then OWA or ActiveSync have to do. We don't want someone's mail in a PST/OST on a computer that we don't own.
4- We tried to setup RPC over HTTP two years ago and failed. We haven't tried since the "Outlook Anywhere" concept arrived. We are going to look again this summer. For security reasons, it won't be activated unless we can restrict the connection to domain computers.
To respond to your questions:
You could open IMAP to the Exchange server from the internet, and have an Exchange account and an IMAP account configured in Outlook. I would not do that .. the client configuration will be difficult to manage, the users will struggle, and although I don't know for sure it smells insecure.
If you don't want VPN and must have Outlook then setup RPC over HTTP. Those who use it love it, and apparently it is quite secure. We never got it working, but we have an ISA proxy gateway, which was "best practice" when we implemented but has since fallen from favor.
If possible, I would not allow non-company computers access to the network or to Exchange via Outlook, for the reason I noted above.