The cert fingerprint is used to ensure the remote identity, only correct?
Exactly, it's for avoiding a man-in-the-middle attack, if one can redirect the hostname or get somehow else between you and the server.
For self-signed certs this is required, you could omit it for certificates trusted by the system, if you want.
2) Is fingerprint is from the public visible certificate?
Yes, as you can verify by using your web-browsers certificate information and compare it with the one from the overview "Show Fingerprint" helper.
3) If port 8007 is open to the public, the password is the only means to protect from unauthorized access?
If you do not further protect it, then yes. You can always do things like fail2ban, firewall it off for known OK src/dst IPs (for sync jobs, just fine), not using root but a more limited user for stuff like backups, remote-syncs...
https://pbs.proxmox.com/docs/administration-guide.html#access-control
I ask because the internal passwords are often not strong enough to protect an internet resource. E.g. with ssh I use shorter passwords for acces from the local LAN but disable passwords for WAN and use public key authentication instead, which is much safer.
Why not simply set a strong password then? Comparisons between asymmetric and symmetric encryption are hard to do right and in a meaningful way, but there no reason to believe that, for example, a 64 byte (512 bit) symmetric used password is weaker than a 4096 bit asymmetric RSA key - especially for automatic scheduled things like remote syncs, where the private key cannot be additionally encrypted symmetrically like it's often done with SSH.
Rather one should use the planned features of TFA for interactive and powerful users, and API tokens with minimized permissions for non-interactive uses.
FWIW: if you really want, you can use SSH or wireguard to establish an asymmetric key protected tunnel between two servers and do everything through them.
