Blockchain.info email backup .json file

[Patel]

Hey,

Every time I do transactions in my blockchain wallet I get a email with a wallet.json file as a backup. It says that file has everything needed to recover my funds.

If someone logs into my email, downloads the file, and recovers it on their blockchain wallet, does this mean they have access to all funds?

I have 2FA on, but my main question is, is this email backup a big security risk if someone gets their hands on it?