How do you know they aren’t? Secondly they would still have to find the private key. Similar to if I physically came to your house would I be able to find your private key?