Wouldn't the wrench attack in this instance just make you type your password to your broker, sell the ETF, and then transfer the money to some third party bank account?
This is already the case for the majority of asset (stock or bond) wealth. The threshold to pull this off is way higher than simply getting a private key or hardware key device off someone. In the first case there are many controls to halt or prevent this sort of thing. In the second, if the perp gets the key, they've won.