yes, anyone with your private key can use the account - post, edit profile, etc

there are extensions such as alby and nos2x that protect your key from webapps, which reduces risk a bit, but we need better tools, will take some time