Yes, if you have an unencrypted wallet.dat then this is a very real possibility. Even an encrypted wallet.dat is vulnerable without a strong password and good security practices. It's simply a list of private keys encrypted with AES. AES can't be hacked, but a weak password can. FWIW, people who've lost their password for the wallet.dat have not been able to retrieve their funds, so an encrypted wallet.dat stands the test of encryption.