Is it safe to use walletpassphrase with bitcoin-qt rpc call ? I can think of a security problem, suppose hacker was able to insert some kind of program that call each second to the wallet with sendToAddress and the hacker bitcoin address, now he will get a lock response each time until the call will execute on the timespan the wallet is unlocked. is it possible ?
The wallet passphrase protects against an attacker who has access to your disk but not the rest of your system.
If someone has access to your bitcoind through RPC, you need to protect by setting an RPC password, not a wallet encryption password.