Stealing private keys (through whatever means) is considerably easier than stealing a comparable amount of mining hardware then running it. It's not that big of a risk in reality of course, but there is still a considerable amount of security provided by the fact that obtaining enough compute for a 50% attack is harder than obtaining enough eth to do the same.