It's just as simple as this: the more you use a password or a private key, the more likely it is that someone will somehow gain access to it and steal it. How exactly they would do that is fuzzy to me as well. :)

Also when sending people steem or sbd you have no choice but to enter your active key (or your steemit.com password). It's best practice to log into steemit.com with only your posting key for this very reason, even though that makes it less convenient to send funds.