I encourage users to not use MetaMask to store more than they are willing to risk to a hacker, for longer than they need to, and that's the same for any internet connected signer.This is usually considered less secure, because if a machine is on the internet, it could be accessed remotely, and keys could be stolen.
Wont be that complicated if the user isnt stupid to use other extensions or install malicious applications,what would you recommend if the reputable metamask isnt secured? do you have any other alternatives? you shouldnt be saying its unsecured because you dont have proofs that there are some hack incident with using metamask extension,only those fools who will give their seed phrase would get hacked.