Because in your wallet the private keys are encrypted with your passphrase
So when you generate a private key, bitcoin-qt needs the passphrase so that it can write it (after encrypting it with the passphrase) in the wallet
Does it generate a new key for the key pool right away?
Yes, actually the new address is not generated, it takes an unused key from the pool to give it to you as a "new" one
Then to keep the same pool size it generates a pool key