Steemconnect actualy use an authentication token. Even if someone manage to get in, they will not get your private keys AFAIK. There is Keychain extension which allow you to securely store your keys which I use whenever it is possible to use. But if someone directly ask for my private keys, I would be very careful and only hand over posting keys.