There has been big media coverage that an application can just go and read the keychain without needing the master password, root access or anything. It just needs to be executed.
But one thing I didn't see covered by the sites I read at least is WHY this is possible in the first place.
After all, if you would normally make a password database that acts only upon entering the master password, it would be common sense to:
a) encrypt the keychain with the master password (if you want/need you can use other things as well like the secure enclave key, but the master password must be part of whatever will be the derived encryption key)
b) do encryptions ONLY in the RAM (not in swap)
c) make sure NOTHING except for root or the keychain-managing application can access that area of RAM
d) destroy everything you have put in RAM after you have finished
So why can an attacker with a simple application being executed, use a hole in the system to read the keychain without anyone entering the Master password?