it's not that the password doesn't matter. it does. however, you won't be needing it. it's a password to issue rpc (remote procedure call) commands to the daemon which is not relevant to your situation. it is however, relevant if you put a very easy password and enable rpc and somebody were to try to "hack" your wallet.. then they could issue commands to send the funds from your wallet. while it seems very unlikely anybody would do such a thing (or find your wallet out of all of the wallets should they try) it is still a good plan to not put something simple there. I believe that if it is totally disabled everything will work fine. you don't need RPC commands since you aren't running a site or remote wallet. if you disable the username and password it will result in "impenetrability" , rpc commands will be disabled except for local cookie authorization (which is a whole different thing) .. you don't really need to worry about any of that unless you put a very easy password to guess, still would be very unlikely .. securing your wallet by disabling the password or if left enabled putting something extremely complex (unguessable) would be the best course.