he just grabbed the wif from the variable and sent it to his server.... an attacker couldnt actually get the keys that way using steem connect