It is encrypted and can only be decrypted with your password, but it's much easier to brute-force guess most passwords than 64-character private keys. MetaMask wallet are most often compromised through phishing and malware attacks and not direct cyberattacks. MetaMask hasn't suffered any major hacks.
https://sites.google.com/metam....skio.com/metamaskwal