True dat. But if they compromise your computer the first thing the look for is key files.

Like my ssh keys are in a root permission file. Protected from general sight, but if somebody compromises my PC with a CVE on then goodbye keys.

At least with hardware key it is removable and requires a button press.

So accessing becomes physical access or quantum computer cracking