My point is that there are security products with configurations where the keys are cleared from RAM when the system is not running (including hibernation modes

My point is that there are security products with configurations where the keys are cleared from RAM when the system is not running (including hibernation modes). Therefore, in those configurations they are at most only vulnerable while they are running. Used in that way, this greatly mitigates the risks mentioned in the article.