Yes, but you can use 2-factor auth to control downloading the keystore, so in order to hack the person's account you need to already have physical possession of

Yes, but you can use 2-factor auth to control downloading the keystore, so in order to hack the person's account you need to already have physical possession of one of their devices and the master password (either to access their keystore or to get through 2FA). And if it's not a 2FA device, the victim can use 2FA to push a disavowal of the old keys and set up new keys. That's an ugly and server-centric solution, but "halp I got hacked" is going to be an ugly case no matter what.