Using strong password  is the best, but always will be ways to crack
the password if you have access to dozen of machines in cluster.
I think the best option here is combining strong password for the vba,
plus code obfucation techniques to try difficulting the understanding
of your vba  code, plus isolating confidential and important code in
exported dll called in your vba code and also using protection and
hiding techniques in this dlls. Even with all this experts could
reverse engineering your code but for normal and some advanced user
your code could be save.