I'm syncing a full BTC node onto an external hard drive, which I'm connecting to by USB. I've created a bitcoin.conf file which sets a very insecure rpcpassword. This is literally the only field I put in the bitcoin.conf file. In what way does this matter?
(I've just changed the password. Should I restart the sync, given that it's 49% through?)
By default the RPC interface is only exposed to localhost (127.0.0.1 and ::1), not to the world. In that setting, you need an RPC password only to protect against untrusted local users on your system (unless you're somehow tunneling the RPC port 8332 out).
That said, why do you have an rpcpassword at all? If you're only going to use bitcoin-cli for example you don't need one since version 0.12 (see https://bitcoin.org/en/release/v0.12.0#rpc-random-cookie-rpc-authentication). If you need for having external applications to to bitcoind, rpcauth is preferred over rpcpassword.
There is certainly no need to restart syncing.
The RPC interface is not exposed to anything except localhost by default. So other people on your network, nor people on the internet, can access it unless you have explicitly enabled outside access using rpcbind=<ip> and rpcallowip=<ip>. So even using an insecure rpcpassword should be safe. Furthermore, it is completely useless if you don't also set rpcuser.
However rpcpassword is deprecated and it is not recommended that you use that. In fact, it is not necessary for it to be set in order to access the RPC interface. A RPC user and password will be provided in the .cookie file that is found in the data directory. bitcoin-cli will automatically use the user and password set in that file.
(I've just changed the password. Should I restart the sync, given that it's 49% through?)
Restarting Bitcoin Core will not restart the sync. It will continue where it left off when it stopped. Nothing will be lost if you restart.
