Question: If I am uploading a CSV file via dataloader into Salesforce, is this data flowing into Salesforce encrypted? Would someone be able to sniff out the data sent by dataloader to Salesforce - and see it as non-encrypted data?

Answer: 
The upload is done over HTTPS that encrypts the data as it is transmitted. HTTPS is widely used to ensure that the data being transmitted can't be intercepted and looked at (sniffed).

Generally thinks like obvious passwords or data ending up on a laptop that is lost are bigger security risks.
I am not sure if this is the answer but hope this helps

<https://developer.salesforce.com/docs/atlas.en-us.dataLoader.meta/dataLoader/command_line_create_encryption_key.htm>