That is why it is called a private key which nobody is suppose to have access to apart from you. Your coin can been spent if someone gets access to your private key which will be imported to a non custodial wallet and your coin will be spent easily. Your private is your personal key, if anybody have access to it, it is as if the person has a spare key to your wallet.

Yes the person will be able to withdraw your money which you can never recover back again, your private keys is as important as your coin, so you have to put it in a safe place no one can have access to it.