The install folder should be deleted after installation — as noted on the final page of the installer. However, as long as nobody knows your MySQL access details, it's safe to have online as well. If your /install folder is in place and not renamed or deleted, the system will redirect you back to the installer and prompt you to delete it (except in a certain early 1.20 build where I had forgotten to reactivate this from my local testing).

The upgrade folder should also be deleted, as it's not needed for anything. The upgrade script is admin access protected, so there's no security risk in having it online either, but it's unnecessary. The 1.11->1.20 upgrade script (as noted when you run the upgrade script) can be run again if you want to delete the old 1.11 layout backups all at once. If the 1.11->1.20 upgrade script detects your system as version 1.20, it presents you with the cleanup phase.

    case "phase_cleanup":
        Queries::do_query("DELETE FROM ".TPRE."layouts WHERE lay_ident LIKE '111_%'");
        Queries::do_query("DELETE FROM ".TPRE."columns WHERE col_parent_ident LIKE '111_%'");
        Queries::do_query("DELETE FROM ".TPRE."units WHERE unit_parent_ident LIKE '111_%'");

If you have upgraded to 1.21 since, and have the old 111_ prefixed layout backups you want to remove, and if your system number doesn't register as 1.20, you can open up the upgrade_111_120.php script and change line 209 as needed:

        if ($sys['fdata_content'] == "1.20")

If you have other questions about installation and upgrade in general, please let me know.