Because it is a Watch -only wallet, it can not send bitcoin. So wallet password is not important.
Without a password, anyone who can access your device can spy on all your transactions and balances, potentially making you a target for further attacks.
If you are using watch only wallet without tor, you are also leaking your information to the central server. Information like IP address and your wallet address would be leaked.
Even with Tor, you still leak all your addresses and allow them to be linked together. The only way to be anonymous with any Electrum wallet, watch only or not, is to connect it to your own node/server.