There are still plenty of computers out there that are probably running vulnerable versions of Flash/Java etc. I imagine one of the biggest incentives to hack some random blog is to infest it with drive -by malware and compromise a bunch of machines if it has high traffic.
Also if you have a keylogger on a machine you can look for things that might be site admin passwords. So it wouldn't surprise me if there was a relatively symbiotic relationship.
If you're storing them in lastpass, then they can grab them regardless.
If you're storing it in an encrypted partition, then they can grab them regardless.
Once somebody has access, it's game over.
A software trojan, that can capture keystrokes, mouse movements, selected text, screenshots... Most certainly yes. :(