Well, you don't need physical access if you can successfully get your malware installed on the target's computer. At that point a text file would be easier to s

Well, you don't need physical access if you can successfully get your malware installed on the target's computer. At that point a text file would be easier to scrape that a password protected file, but only a few more steps away, i.e., by logging keystrokes or impersonating a login prompt or whatever. On the other hand, passwords stored in the browser are vulnerable to a compromise of the browser as well as a system compromise, so that is one additional weakness. I agree that a local system compromise is almost always game over. The same as physical access. To answer your question, I'm not sure, but IIRC the Lastpass client was compromised more than once. There were also weaknesses in the way Chrome stored passwords, and of course the Firefox credentials file is easily readable without a Master password set.