is wallet vulnerable when unlocked for transactions?
You can create, sign and broadcast transaction on different machines. When private keys are offline it's called cold storage.
Example: Create unsigned tx (PSBT) in a watch-only wallet using bitcoin core, sign it in electrum and broadcast using bitcoin core