you don't worry about having such a large cache of personal information in such a weakly protected storage location? Would you even be able to detect any ongoing intrusion?
I doubt his home computers are any less weakly protected than Evernote's servers.
You think his computers accept logins from anyone on the internet that types in his url, with a password that can be reset using his email and/or a security question?