The RPC interface is not exposed to anything except localhost by default. So other people on your network, nor people on the internet, can access it unless you have explicitly enabled outside access using
rpcallowip=<ip>. So even using an insecure
rpcpassword should be safe. Furthermore, it is completely useless if you don't also set
rpcpassword is deprecated and it is not recommended that you use that. In fact, it is not necessary for it to be set in order to access the RPC interface. A RPC user and password will be provided in the
.cookie file that is found in the data directory.
bitcoin-cli will automatically use the user and password set in that file.
(I've just changed the password. Should I restart the sync, given that it's 49% through?)
Restarting Bitcoin Core will not restart the sync. It will continue where it left off when it stopped. Nothing will be lost if you restart.