Keychain will not automatically store all the passwords you use in Safari. It will ask you the first time you enter a username password for each site. You can say yes, later, or never (or something like that). So if you have an extra sensitive site (like your bank) that you don't want to trust to Keychain you can just say never, and it will not be stored.
All contents are encrypted, so it's not a big risk, provided you lock and password protect your iPad so other's can't just pick it up and start visiting your sites.
You can also go into Settings > Safari > Passwords & AutoFill > Saved Passwords to see what sites have been saved, and delete any you don't want saved or want to clear so that you can redo them.
The main advantage of Keychain as opposed to iOS 6's old auto-password feature is that you can sync the passwords across all your iOS and Mac computers. One password list to rule them all. Provided you turn it on on all devices.
If you are the sole user of your iOS and Apple computers (or have your own unshared login in the case of the computer) then it is handy. If you share your device(s) with others, who you don't want logging into your sites, then you should leave it off.
I use Keychain for common sites that I don't really care if an iPad borrowing relative happens to peek , for ease of logging in. For important sites, like banks and other places where money or important stuff resides, I use 1Password. It's not as convenient, but it stores stuff behind yet another password that must be entered every time you open the app, and it also syncs to all my devices and computers.