True, but in real-world systems, attackers cheat. Their job is to recover the key, not to follow some rules of conduct. Prudent engineers of secure systems anticipate this and adapt to it. It is our belief that most operational cryptanalysis makes use of side-channel information. And in his book Spycatcher, Peter Wright discussed data leaking onto a transmission line as a side channel used to break a French cryptographic device.
Defenses are hard.
You can either reduce the amount of side-channel information that leaks, or make the leakage irrelevant. Both have problems, although researchers are working on them. This is a powerful attack, and it will be a while before there is a good theory of the defense. In the meantime, any system where a device is held by one person, and the secrets within the device are held by another, is at risk. We argue that PRNGs are their own unique type of cryptographic primitive, and propose a model for analyzing them.