Should a JSON-RPC user be required to use a password when backing up the wallet?
The JSON-RPC was never intended to be open to the public, hence the required rpcuser and rpcpassword. For added security it should also be configured to either listen only to the loopback interface or the allowed IPs limited to a few trusted sources.

The wallet password is used to access the encrypted private keys, that's the reason everything involving either adding new private keys or signing with the private keys requires the wallet to be unlocked.

backupwallet exports the keys in their encrypted form and therefore does not require the passphrase.

If you have to allow JSON-RPC access to untrusted users, put a filter in front of it.