Does rpcpassword need to be non-obvious in bitcoind? I'm syncing a full BTC node onto an external hard drive, which I'm connecting to by USB. I've created a bitcoin.conf file which sets a very insecure rpcpassword. This is literally the only field I put in the bitcoin.conf file. In what way does this matter?

(I've just changed the password. Should I restart the sync, given that it's 49% through?)
By default the RPC interface is only exposed to localhost (127.0.0.1 and ::1), not to the world. In that setting, you need an RPC password only to protect against untrusted local users on your system (unless you're somehow tunneling the RPC port 8332 out).

That said, why do you have an rpcpassword at all? If you're only going to use bitcoin-cli for example you don't need one since version 0.12 (see https://bitcoin.org/en/release/v0.12.0#rpc-random-cookie-rpc-authentication). If you need for having external applications to to bitcoind, rpcauth is preferred over rpcpassword.

There is certainly no need to restart syncing.