TL;DR - Not that much risk, there's more important things to prioritize from a security standpoint.
First off, what kind of data will be stored on this device? What kinds of accounts will be logged into? Banks? Work data? Financial data? Medical data? etc...How important is your dataset. This is a key question when trying to decide how much effort to put into securing it.
There are really 2 types of attacks when it comes to trying to steal data off a computer:
- Physical - Physical theft of computer/device
- Virtual - Remote (or local) exploitation of a vulnerability on a given machine
For physical theft, drive encryption software is the smartest way to protect yourself. When the hard drive is encrypted, an attacker who stole a laptop cannot take out the hard disk and attempt to read the data on another computer because the data is still encrypted.
Data encryption is a very strong protection against data theft via physical loss and is your best bet to keep your data safe from theft. Without encryption, an attacker can easily read all your content off the disk.
Virtual attacks have a lot more variety and obviously don't require physical access. The most common virtual attacks don't typically need your local user account password.
For example, a spear fishing email where a user opens a malicious PDF that exploit will already be executing as the user context, so the user password doesn't apply... once you run it you're done as the process is already running as your logged in account. This is a prime reason why to never run as root or Administrator, to try and limit the impact of getting exploited. Imagine Notepad++ asking to install updates for example, turns out those updates can be spoofed.
Really important to keep software and your system up to date. "Exploit kits" are used attackers to quickly scan computers for a variety of vulnerabilities that have exploits and all they need to find is one. This doesn't require a local admin password either.
If an attacker was attempting to brute force credentials, there are modern defenses against this including time out mechanisms to discourage and disrupt this type of attack on things like RDP and SSH. Using the same password for multiple accounts is a really bad idea as well. Attackers have tools to auto login to hundreds of sites using the same user name and password so they will find out if you share them. All it takes is one site to get hacked where you have a shared password... boom your Groupon account just got hacked and because it was the same password as your paypal account you got to deal with 7k in fraudulent charges.
Use LastPass to protect yourself by generating unique passwords for all your sites. No one expects you to remember all unique passwords and this service is the best option we have today.
Bottom line is, there are typically a lot of easier ways to exploit a user than needing their local account password.
So my recommendation is:
- Use disk encryption
- Don't reuse passwords for other sites / computers. Use lastpass.com to help maintain unique, secure passwords.
- Keep your systems and software patched
- Always be skeptical of emails and attachments unless you are expecting them.
If do all that then you can use an easy password for her local user account and still be pretty damn safe.