Scenario for applying power analysis
This seems to be correct.

I do see one possible attack vector where repetition of the request could be used for DPA attacks on the decryption key. It is basically the plaintext when looking at the decryption using the passphrase. It is also the encryption / decryption key for the subsequent operation using the key. But that's a scenario that is less likely than an attacker holding the smart card and trying to use DPA to retrieve an encryption key.

If you send the password in plaintext then you should of course consider the security of the password before it actually reaches the smart card. DPA attacks are not interesting if the adversary can simply eavesdrop on an unprotected password.