You are correct. There is no "vulnerability" here. The plaintext of the user's private keys must be accessible to the CPU performing the cryptographic operations. DPAPI is a reasonable method to keep the keys encrypted "at rest" while allowing the keys to be decrypted w/o the requiring password entry each time the keys are used.
It is helpful for post-exploitation toolkits to have this functionality.
It is helpful for post-exploitation toolkits to have this functionality.