I agree that a witness key would be beneficial. However, it's not too much of an issue currently.

a) Collaborate with people you trust.
b) Since all rewards are paid in SP, you always have 7 days to react to any moving of funds.
c) You can set a power down withdraw route to a different fund account entirely, so the witness account never sees any liquid funds. Should someone change the withdraw route, you once again have 7 days to fix the situation. That'd be enough of a deterrent so no one tries anything funny.
d) Multi-sig. I don't really know how that works, but I know it's there on Steem and @steemit uses it.