If the private key(s) are/is in the wallet.dat file, then isn't it overly exposed to hackers? Can't a hacker just read my C:[dir]\wallet.dat file and take all the bitcion?
Yes, if you have an unencrypted wallet.dat then this is a very real possibility. Even an encrypted wallet.dat is vulnerable without a strong password and good security practices. It's simply a list of private keys encrypted with AES. AES can't be hacked, but a weak password can. FWIW, people who've lost their password for the wallet.dat have not been able to retrieve their funds, so an encrypted wallet.dat stands the test of encryption.