malware could just capture that

From the article:

This means that while a keylogger might require admin access to install, any app or script with sufficient permissions could access these plaintext keys.

Malware to capture input would require privilege escalation as well, whereas this just requires being able to run code/copy files.

there is not a simple solution

But there are:

• use the system keyring
• store unencrypted key in memory in a background process (I.e. DIY keyring)

Essentially, force malware to either copy keystrokes or memory, both of which require admin privileges on most systems.

Storing the encryption keys in the Credentials Manager (Windows) or the Keychain (macOS, Linux) would be a better choice than a plaintext file.

And using Bitlocker / VeraCrypt / Filevault / LUKS will at least protect the data at rest.

But as you said, it's game over if the machine is compromised.

It's right there in the article. Local keychain.

Agreed. If your system is compromised you have other issues and ultimately that falls on you. And on Linux you could very well set permissions yourself for those directories.