If the wallet.dat is not encrypted, anyone downloading it can import it into their own Bitcoin Core client and drain the funds.
Even if the wallet is encrypted, the wallet.dat file can be downloaded and subjected to offline brute-force attacks to crack the password, which is often easier than attacking the live network. indexofbitcoinwalletdat link