If you don't use a password, I would assume they could connect to your hotspot, so, that's probably a bad idea already. If you want to test it, connect another phone to your hotspot and see if you can access your phone, delete files, etc. But, just put a password on there. No reason not to, right?