An open port and a working service are not the same claim, and nmap is considerably more careful about that difference than most people reading its output.
State is not capability
A state of open means a SYN-ACK came back. That is all it means. It does not tell you the service is healthy, that it will accept your protocol, or that the banner is truthful. filtered is the genuinely interesting result: something dropped the probe silently, which tells you about the network path rather than the host.
Version detection is a guess with a confidence score
The service and version columns come from matching response fingerprints against a signature database. A reverse proxy, a load balancer, or a deliberately edited banner will all produce confident-looking output that is wrong. Treat the version column as a hypothesis to confirm, never as a fact to act on.
$ nmap -sV --reason -oA scan 10.20.0.15
PORT STATE SERVICE VERSION REASON
22/tcp open ssh OpenSSH 8.9 syn-ack ttl 63
80/tcp open http nginx 1.18 syn-ack ttl 63The --reason flag is the habit worth forming. It shows you why nmap made each call, which is exactly the information you need when a result later turns out to be wrong. And -oA costs nothing now while saving you from re-running a scan you have already done.
Timing changes results
Aggressive timing templates drop packets on congested links, and dropped probes get reported as filtered. If a result surprises you, re-run it slower before you build a theory on top of it.