What are you trying to protect against?
If you're trying to stop someone who has physical access to the machine and who is seriously keen on accessing your data reading stuff that's on it ("evil maid attack"), then forget it, you can't win that one.
If you are trying to protect against incoming nasties over the wire or wi-fi, because when travelling you won't have your normal sleath mode router in between you and the internet, then getting patched up to date is what's most important. (You could try switching on a firewall but I've always found them more trouble than they're worth.)
Yes you probably should set a password. It'll be a small stumbling block to a casual thief, who is after the hardware not the data. Just about worth the effort.