This is scary if accurate.

For people unfamiliar with Keychain, the problem as I understand it is not that unsigned apps can do this per se (though I don't think this is a good idea), it's that they can do this without user intervention.

The normal flow for Keychain is that when an app wants access to a keychain item that was not created by that app, it has to ask for user permission to allow once or always allow access. It sounds like this isn't happening in this case.

(Aside: it used to be possible to trivially access all website passwords in Safari too (which I dutifully reported as a bug, because it was a terrible design choice), but Apple thankfully changed this to require authentication in new versions of Safari.)