True dat. But if they compromise your computer the first thing the look for is key files. Like my ssh keys are in a root permission file. Protected from general sight, but if somebody compromises my PC with a CVE on then goodbye keys. At least with hardware key it is removable and requires a button press. So accessing becomes physical access or quantum computer cracking