I was reading this documentation and saw this part;
When an application performs cryptographic operations using an Android Keystore key, behind the scenes plaintext, ciphertext, and messages to be signed or verified are fed to a system process which carries out the cryptographic operations. If the app's process is compromised, the attacker may be able to use the app's keys but cannot extract their key material (for example, to be used outside of the Android device).
It makes me a bit confused as I don't quite get how being able to access app keys but not the "keying material" is still safe (or secure). I mean if the key is the ultimate output of a KDF, does it make any difference not being able to access the corresponding keying material? I can still use the keys, for example, to decrypt messages, right?