I think you're turning the question around the wrong way - there are hundreds of thousands of apps and services on the internet that all force you to make an account with their service to use their software, access data you've uploaded to their service, and interact with other users. That's the thing that is a huge hassle and also, increasingly (with web3 and on-chain applications growing in popularity) a huge security problem because of the attack surfaces those services' front ends offer. On Urbit none of this is necessary, because the "account" (i.e. network identity and keys) of your ship is already baked into all your interactions with the network.

As far as the apps having access to cryptographic secrets you store elsewhere on your Urbit ship: the apps are all installed and running on your ship, so just like other software running on a computer you control they can have access to other local data if you intentionally give them permissions, or they can have no access, or they can have access conditional on some additional safeguard. It depends how you write the app. But an app always knows the Urbit identity of the ship it is installed and running on, and that is baked into messages the app sends to other ships.

You also have the ability to spin up 4 billion virtual identities ("moons") per primary identity ("planet"), and it is a standard use case to run an app/service you don't want to interact with the rest of your ship on one of your moons. The main value currently is, if you host a high-traffic groups or distribute a popular app, these would make your primary ship run slow so you stick them on a moon. But the reason Urbit was designed to associate each identity with 4B virtual identities was so that your IoT devices can communicate with the network without having access to your personal computer.