Did you consider that the code is open source?

I think it may not be reproducible and if that is the case, I 100% agree but if not then it is just a sophisticated hot wallet imo with 2 hot keys.

I imagine that Bitkey keeps their remote keys on secure elements, so it's not a break in and grab situation, but they could have a bug in some time period created by the hacker that effectively allows an attacker to spoof a request to sign a transaction making the server work for them.

Still, there is a significant amount of obstacles for a third party hacker.