This is not true. If the private keys are encrypted in the wallet and in memory and only unencrypted at the time of sending BTC to a different spot in memory each time and then promptly erased from memory. This would be a reasonable amount of security and make it difficult for a Virus or Trojan to steal the private keys. The only problem I see with this method is people losing their password to their private keys but I think that also Bitcoin Clients should mandate the user backing up their keys unencrypted to a removable device or print them out at time of key generation.
This would be a shitty security method that would protect you only from the most noob script kiddie.
Two ways to hack it:
* the simple: wait for the window asking the password to appear and take the password (keyloggers)
* the "a little harder": You know (by looking at the source, the client is open source, you know?) in which function the key is unencrypted, you wait for the exe of the client to be loaded (you are a trojan, you are resident in memory), put a breakpoint there and snoop the memory. Each time a new version of the client is created you lose half an hour to "expand" your library of possible breakpoints. Hackers do more complex things to games that are protected by latest generation protections. You think that an open source software that anyone can compile is more resistant? Encryption will only make the wallet.dat more resistant to "one shot" trojans that enter, steal and exit (or to trojans written by script kiddies that don't know assembly). This would steal one private key at a time, if the program is well written (but then, if you are already putting a bp in the code, you can directly steal the password).
The only "possible" way would be to make the program polymorphic, like the viruses, so it would be more difficult to put a breakpoint in memory, but it's quite complex... And it would protect only against the second method. And in the end the trojan would simply replace your exe with another one that would only ask you the password and send it to the hacker.