Encrypted sparsebundle password appears to be cached
From the hdiutil man page:

unmount volume [-force]
            unmount a mounted volume without detaching any associated
            image.  Volume is a /dev entry or mountpoint.  NOTE: unmount
            does NOT detach any disk image associated with the volume.
            Images are attached and detached; volumes are mounted and
            unmounted.  hdiutil mountvol (or diskutil mount) will remount
            a volume that has been unmounted by hdiutil unmount.


The image encryption key isn't discarded until the image is detached, so after hdiutil unmount you'll be able to remount it without supplying the password. Solution: use hdiutil detach (or the eject button in Finder) instead.