If the wallet is stored via Berkeley DB, it should be easy to turn on DB's automatic AES encryption feature.

I agree the wallet should always be stored encrypted.