Ah, I get it. So, they can spend my coins that where already in the wallet at the time of the backup / or before I changed the password (that part I didn't get straight), but they cannot spend the new coins that arrive there.
This is wrong. They can get coins from any address the wallet had at the time of the backup including the address in your keypool. This includes coins sent to these addresses after the backup.