Well without getting into general client-side precautions a user might do, and in addition to the points I've already made, I have another idea for what Steemit could do. That is make all interactions with the "owner" or master private key password take place on a different domain so Content Security Policy and the browser sandbox can protect those interactions against cracks due to user-generated content which [@dan mentions](https://bitcointalk.org/index.php?topic=1567519.msg15840117#msg15840117) as an additional current vulnerability of Steemit compared to Blockchain.info.

Edit: this was [previously suggested](https://steemit.com/steem/@karnal/hackmoar-hindering-attackers-coming-and-kidnapping-my-outrageously-armored-resources) as a "standalone app".