[jdyer9]

As another commenter started to point out, the risk is essentially cloning the key. So, if you were out to dinner and it was cloned while you were out, you might not realize you'd been compromised whereas if it was stolen, it might too late, but you'd know. It seems that for many/most people the risk is low, but anyone at risk of a state sponsored attack should be aware.

For the threat model of keeping out random online attackers with no physical access, it seems this vulnerability doesn't matter.