> The CryptProtectData function performs encryption on the data in a DATA_BLOB structure. Typically, only a user with the same logon credential as the user who encrypted the data can decrypt the data. In addition, the encryption and decryption usually must be done on the same computer. For information about exceptions, see Remarks.

https://docs.microsoft.com/en-us/windows/desktop/api/dpapi/n...

If you can execute code on the computer (as the user), you can decrypt the credentials.

Scary how easy it is to steal it all :(