The wallet does not contain the coins. It contains the keys to spend coins which are assigned to the corresponding addresses. The coins themselves, if such a thing exists, are kept by the network.

If you try to spend a coin twice, the network will only accept the first transaction to do so.

Thus only way to prevent against theft is bitcoin client with encryption else trojan can steal.

even without spending, just by having the wallet file unencrypted in your disk you are already open to the possibility of your money being stolen. Even if the wallet is encrypted, there is still the risk some malware might sniff the data while a program decrypts it to RAM. And even if you don't launch any program that touches the wallet yourself, malware could still do it unatended, if you saved the password for decrypting it that could be used, or the malware could transmit the encrypted file to the attacker's machine and the attacker could attempt to find the password using a dictionary and even a bruteforce attack.


There are all sorts of ways your coins could get stolen