Yeah, I'm not a programmer but it seems logical. There are many witnesses on the blockchain and they can't simply alter transactions. -But they can initiate transfers remotely and transfer the money as if the user did it.