Except one requires the attacker to read from the processes memory in an organized way for an extended amount of time to snoop data while the other just puts it

Except one requires the attacker to read from the processes memory in an organized way for an extended amount of time to snoop data while the other just puts its conveniently onto your disk.