Yes, you are right. Crypto users must store keys in an offline device as storing them online is very dangerous. I remember one person lost 5500 bitcoin as his email was hacked and private key was stolen.