Did you consider that the code is open source?
I think it may not be reproducible and if that is the case, I 100% agree but if not then it is just a sophisticated hot wallet imo with 2 hot keys.
I imagine that Bitkey keeps their remote keys on secure elements, so it's not a break in and grab situation, but they could have a bug in some time period created by the hacker that effectively allows an attacker to spoof a request to sign a transaction making the server work for them.
Still, there is a significant amount of obstacles for a third party hacker.