> there isn’t much stopping malware from using your hw based key

Except the three pretty major things that do stop malware that you mentioned ;)

Perhaps especially "3. You don’t have touch to auth turned on".