Well, this question is hard to answer. We need to take few things into consideration.
First: Are any there crackers in neighborhood?
Second: Is there any real motive for someone to crack her network key? Remember that sometimes practice is a good answer to that question. Another would be covering tracks for illegal activities. For criminals, it's always better to have a party van come knocking at a neighbor's door than their own.
Next: What does she have to lose in case someone does gain access? There is a chance that someone may use her Internet connection for serious crimes, but I think that it would most likely be that cracker just wants to avoid paying for Internet. If her Internet connection is charged by the amount of data transfered, then this may be a problem.
Next: Is there anyone who is willing and able who wants to target specifically her? If there is, no amount of MAC whitelisting and complicated passwords are going to save her. An enemy will be able to find a way in. If not, then her best bet is to be a more difficult target than it is usual for the area. If someone is just looking for an Internet connection to use, he'd probably look for the least protected one.
Next: What are her chances of detecting intrusion? A few years back I set up a wireless network at my friend's apartment (who has very bad relationship with computer security) . He later added several more computers and everything worked fine. I was visiting him once and during conversation, he mentioned that his Internet connection was very slow lately. I decided to check his router settings. Of course he forgot the password, but I wrote it down on the router just for such occasions. After some investigation, it turned out that someone accessed his network, cracked the password for his router, changed it and had two computers running torrents connected!
So for conclusion, here are my opinions: If she is in a risky neighborhood or if she can't detect that someone is using her connection or if Internet crime is aggressively prosecuted in her area, then it's safer to leave the access point off and turn it on when needed.
If there is a low chance that someone is going to pick her as a target (for example there are unsecured or WEP networks in the area) or if she can check router logs every few weeks a most, than with a good passphrase she should be safe.
Keep in mind that MAC addresses can be changed on network hardware and even if there is no active connection, the access point may be provoked enough to emit enough packets to make the key vulnerable.
Another interesting point is the router itself and available options. If there are settings for key lifetime, they should be set to short. This way, there will be lower chance that it can be cracked, especially if activity of the network is going to be low. It would be a plus if router can send e-mail if someone keeps poking around it and if it can send its logs periodically, but such features aren't common among home routers. Another plus is if there can be set a list of IP addresses from which admin access would be allowed.
