SSL certificates are a means of protecting against "man in the middle" attacks: http://en.wikipedia.org/wiki/Man-in-the-middle_attack.
Without an SSL certificate it is possible for the request from your browser to the server to be intercepted and for the interceptor to read your password out of the request, since the password will just be in plain text.
If you are using an SSL certificate, then the request would be encrypted, so even though the request could be intercepted, the interceptor would have to decrypt the request to be able to see the password.
Ideally, you would have an SSL certificate, and there is a big push to get more and more sites using SSL certificates, such as Google now factoring whether a site supports SSL into their rankings: http://searchengineland.com/google-starts-giving-ranking-boost-secure-httpsssl-sites-199446.
There are really 2 key takeaways from this:
The data is only at risk while the request is being made. A hacker has to be able to do a man in the middle attack to benefit from the lack of an SSL certificate. This is obviously a possibility, but typically not the biggest risk for a small, non-ecommerce site.
The reason that Joomla does not default to SSL for the admin page is that SSL is required to be installed on the server, not provided by code that you can just download. Since basically all Joomla is self-hosted, you have to work with your hosting provider to add the SSL certificate.
I highly recommend adding one if you can. There are even free certificates available here: https://www.startssl.com/. Many hosts charge an install fee though, so rarely can you get away without any cost to adding the certificate.
bcrypt
password encryption which is one of the best so for the backend login, SSL is not required. For an e-commerce site, it's not mandatory, but it should be done. Joomla 2.5 uses md5 + salt which is secure, but not as good.