1. presumably people using pass are using some sort of syncing system, which might be cloud based or otherwise compromised.

2. if that's "game over anyway", you might as well store your passwords in an unencrypted .txt file :^)