That's not a bug, it's how they were designed. Someone could steal your secret key and make an unauthorized transaction with cryptocurrencies too. Only, then you would have practically no recourse.

"Unauthorized payments" is a bug. It's an unfixable bug for which they've created a recovery system, but it's still a bug, because the system is not intrinsically secure.

"Steal your secret key" is not a valid analogy to a having a credit card number stolen. The information density of a secret key is orders of magnitude higher than credit card info, and that's why it has provable security properties that credit cards do not. Credit card info can in principle be brute forced where keys cannot.

This means though also face the risk of losing your key and having no way to recover it. This seems like a bigger risk to me.

and my point is that there is an easy way to recover from that situation, where as with crypto you are out of luck.