Yes, but when they’re on USB the keys are much more accessible. You can just plug it in and dump them.

If you’re only using a password, the keys are stored in an unencrypted part of the drive, which can again easily be dumped.

Once you’ve dumped the keys, you can brute-force the passphrase offline.