PPTP is incredibly insecure as you've stated and provides next to no security whatsoever, there are tons of vulnerabilities in it and should be avoided at all costs. You can read more about those vulnerabilities here if you scroll down to Security
L2TP should always obviously be used with IPSec because L2TP doesn't actually feature any encryption if you run it as a standalone, which is why you will mostly see it paired with IPSec.
IPSec tends to be pretty secure. Below is a list of the Cryptographic algorithms it uses:
- Authenticity & Integrity Protection: HMAC-SHA1/SHA2
- Confidentiality: 3DES-CBC it can also use AES-CBC and AES-GCM. It is worth noting that AES-GCM will also perform authentication, so that could be a reason for choosing it.
IPSec will also perform a Diffie Hellman exchange before data is ever sent across a link.
You can refer to RFC7321 to learn more about IPSec, here is a very, exceptional article on the Cisco forums on how it works, I'd highly recommend reading it as it goes into a lot more detail than my post.