The Bitcoin API enables programs on the server to use JSON RPC to interact with the Bitcoin wallet. Most commands do not need the wallet locked (which I assume is the same thing as encrypted).
Though, it would be nice to encrypt the wallet.dat file on the server for extra protection. However, it doesn't seem that I can get any extra protection if my program needs to use the passphrase to execute JSON RPC commands such encryptwallet and sendtoaddress. My program and wallet will be on the server. If a hacker accesses my server, he can get the passphrase from my program file and then use that to access the wallet on my server.
Therefore, is there any point in encrypting the wallet on the server, if I need to use commands such as sendtoaddres which needs the passphrase on the server?