Yes exactly.  You guess the private key "since it was created by a human", then you crack the account.   That is why there are so many Nxt accounts that get cracked.  You don't even need to do the cracking against the network,  you just do it against the public block chain.

If the developers don't think this is fundamentally broken,  then I really question their judgement.