I port scanned my VPS (tor relay) and noticed both port 9001 and 9030 are public facing; accessible to the entire internet. Is this normal? How might a malicious actor interact with these ports? Could someone use tor-arm to connect?
Yes this is normal and infact required, if you want to be a relay.
They could interact with them like any Tor client or relay.
No, neither of those are control ports.