Once a hacker has my Wi-Fi password on Android, can he still enable Location to track my whereabouts even if my phone is not connected to Wi-Fi or cellular data and would he also need a BRATA RAT to do this?
Each Wifi Access Point or Hotspot or Source has it's own password. The password is not unique to your phone, it is unique to the Source.
Unless you are talking about you phone's hotspot's password.
But in any of these cases, Wifi password does not give the hacker access to anything, unless they are able to hack into the devices on that network. To hack into your phone, they would need something running on it.