If some baddie has your secret key, wouldn't they also have a bot that continually listens for 'unfreeze account' messages and, when it gets one, immediately transfers all funds away?
No. Transactions will be sent directly to forging hubs. This can happen only if baddie == hub.