If you create a new wallet.dat, encrypt it, back it up, getnewaddress and send funds to it, does the back up of the wallet.dat also have the new address? Does getnewaddress actually create a new address or just assign one? Is that what the keypool size is?
You don't have to back it up after every new address generation.
But you have to after importprivkey because it's a new privkey added to your wallet.