You can use third party products to encrypt your backups or databases. If this is Express, you can't use TDE, and the backup password isn't really encryption.

If someone has sa/sysadmin rights on their local Express instance, there isn't much you can do.