Learn How to Swap Tokens on MetaMask App & Extension

It is encrypted and can only be decrypted with your password, but it's much easier to brute-force guess most passwords than 64-character private keys. MetaMask wallet are most often compromised through phishing and malware attacks and not direct cyberattacks. MetaMask hasn't suffered any major hacks.