Escape when echoed

In fact to be super pedantic, I think the correct code is actually:

echo '<option value="' . esc_attr( $folder ) . '">' . esc_html( $folder ) . '</option>';

Since the first variable is an attribute, and the second is encased in html, although I wold bet that the code you have would pass review, and is certainly fit for purpose.