How do I add ERC-20 tokens to a Metamsk Wallet ?

It is encrypted and can only be decrypted with your password, but it's much easier to brute-force guess most passwords than 64-character private keys. MetaMask wallet are most often compromised through phishing and malware attacks and not direct cyberattacks. MetaMask hasn't suffered any major hacks.