How can this fix prevent this class of attacks? The malicious app has local access to the user's machine, which means it has the ability to read and overwrite

How can this fix prevent this class of attacks? The malicious app has local access to the user's machine, which means it has the ability to read and overwrite all files that the browser manages. In the worst case, we could create malware that just reads the browser's client public key and create our own session with the same one.