But you need both the master password _and_ the secret key. Even if you write it down on a post-it note, you now need a physical attack to access it on top of

But you need both the master password _and_ the secret key. Even if you write it down on a post-it note, you now need a physical attack to access it on top of whatever attack you needed for the master password.