A VM truecrypt that uses an on-screen keyboard that is randomly scrambled with each startup. User clicks in his passcode. Keylogger fails, mouse recording fails, screen capture does not fail.
Speech to text? Soundcard sniffer?
If LogMeIn, VNC or remote desktop can do all of that, so can malware. A scrambled mouse driven keyboard is no protection against a screenshot + mouse capture, or delta based screengrabs a la remote desktop. Audio + webcam are routinely used for spying, whether in the form of anti-theft (Prey) or highschool scandal where teachers were watching the kids at home like a soap.
Of course I agree that the base attack will most likely be limited, but a simple screengrab with a large enough balance visible will be plenty of reason to upgrade the kit with more sophisticated modules.
It's always good to assume the worst in security, so you cannot depend on a compromise that only installs a DDoS module, especially if Bitcoin becomes prevalent.