About password and physical access
First of all, your wallet must be password-protected and then, as you already said, it will be encrypted. You also need a strong OS password to protect your computer from physical access. And yes, remote attacks are highly possible (in case you installed Daedalus on a machine that's used for web surfing). So Firewall is a good choice, as well as HDD/SSD encryption.
However, if someone downloaded a file containing your private key, the probability of guessing a password for this file depends on the complexity of your password – it can be up to 255 characters long. Brute force methods are still alive (you can explore some rainbow tables for simple and frequently used passwords).
Official docs page says:
Note that password only works to encrypt/decrypt your private key on the computer where your wallet is restored. Anyone with access to the recovery phrase can restore the wallet on a different machine and set a different spending password on that. So keeping your recovery phrase secure is vital!
Hardware wallet pair
The solution is banal – keep your coins on a hardware cold wallet, or, at least, use hardware wallet in combination with Daedalus. In my opinion, "pure" Daedalus (without pairing it with hardware wallet) is suitable for storing a small amount of coins (equivalent of $500 to $1000). Although everyone has their own personal opinion about security.
When you're spending your coins, you need to enter your password. At this very moment, the private key must be decrypted, and after sending the funds, it must be immediately encrypted again.
As far as I understand, there's no need to decrypt/re-encrypt a private key at staking stage...