I'd like to ask a hypothetical question (situation didn't really happen) to better my understanding of addresses and wallet encryption.
I had about $40 in a Bitcoin Core un-encrypted (backed up) wallet.
My hard drive crashed and the computer repair guy was able to recover 100% of the documents that I needed that were saved since my last backup.
When picking up the computer, the repair guy commented, "I noticed you had a Bitcoin wallet so I recovered that for you too".
I restored my entire hard drive image from a week-old backup to a new hard drive including wallet.dat (no activity during the week on wallet.dat).
If I now generate a new receiving address from the wallet and receive funds on that address, would the private key for that new address (and therefore funds) be available to an opportunistic computer repair guy if he were to dump all addresses and private keys from the un-encrypted wallet.dat? i.e., if he generated all addresses in the pool in the un-encrypted wallet.dat, would my new receiving address and private key eventually show up for him?
After all of this, I encrypted my wallet.dat. Does encrypting change replace all addresses from the un-encrypted wallet with new addresses?
Does keypoolrefill replace all old addresses with new addresses in the pool or only just replenish back to the maximum? If replaces, then that one command would insure that I'd get an address that's not in the old wallet.dat.
Do I have to create a new wallet, encrypt it and use a receiving address from the new wallet to receive future funds (and transfer the $40 to an address in the new wallet)? This is a simple thing to do, I just want to understand what addresses are in a wallet using this hypothetical situation.
Thanks.