keychain is on your browser and you're responsible for your security.
Also, any browsers based on chrome can use the plugins as well.

If steemlogin is hacked everyone's keys are getting stolen.