Security concerns with walletpassphrase
Wallet encryption protects funds at rest, it does effectively nothing about protecting funds on a live machine that has loaded the wallet to make a transaction.
There's no expectation that the passphrase will do anything in particular to protect online wallets on machines that contain malicious software, as you've surmised.