I just got a reply from Steemcleaners:
The owner key is public, it’s the digital version of your username, if I understood correctly.

When someone has your master password, but doesn’t know your username or owner key, the password is useless.

So to get to the keys, you need both the owner key and the master password.

When you use your private posting key to log in, and you accidently log into a malicious site, the hackers would only be able to post and comment with your account, but they couldn’t touch your funds or change your keys. Using the private posting key limits the damage that can be done if you make a mistake...