If someone has admin access to your PC (which they need to access the SQLite file) they could also just install malware that sends everything you do and type over the network.
One difference is the speed apparently. You'd need the malware to be installed for a while. With recall you need to exfiltrate a couple kb of data that's already there on disk.
That said, yeah, if the user interacts dumping saved passwords is trivial as well.
That said, yeah, if the user interacts dumping saved passwords is trivial as well.