Aassuming this was real, Apple would store the private key in Keychain[1]. Keychain is encrypted with your login password generally, and can have an ACL to only allow iTunes.app as an allowed application without further user prompting.

[1] - https://developer.apple.com/library/mac/documentation/Securi...

Sure but at least the security of the system is proportional to the strength of your password.