SQL Server symmetric key & certificates games by Hacker?
The purpose of a certificate in SQL Server is to protect the symmetric keys, but it's more for protecting your offline data: .mdb files and backups.  It's not really designed for preventing access to the data once an attacker has access to the running SQL instance (with enough permission to access the data and run decryption.)


If you use a password for your symmetric key, then someone who knows or can guess the password can take a copy of your data and load and decrypt it.
If you use a certificate, then the attacker needs a copy of the data, and a backup of the certificate, and the password for the certificate.