I mean I have them stored locally on my devices so they’d need to both have and compromise the device, which might be a real possibility for like a government threat but I’m not really worried about them stealing my credit cards.