I agree, When you consider that your Genesis account is created with the "Owner" and "Active" keys being the same, if your private key is compromised the hacker can reauthorize even if tokens are staked and then you would have no control of your account. I have created a few accounts for my children that have my account as the "Owner" and their key pair is associated with the "Active". I have also created an account that has its own key pair. My next step would be to change my keys on my genesis account, i am deciding how to generate a secure key pair offline for that, I assume that when i change that key pair that account will still be recognized as the owner of the other accounts. time will tell