I don't know about 25MB of leftover file, but AFAIK after you encrypt your Bitcoin Core wallet, you will use different private key/master private key.
If you encrypt your wallet before you made any transaction or receive coins from address which created before the wallet is encrypted, you have nothing to worry.
Right. And 25mb is a random example.
But what if you've imported a bunch of keys prior to encrypting? Then each individual key is contained unencrypted in the wallet.dat file, no? Does importing keys into an already encrypted wallet prevent the unencrypted keys from betting written to the drive?