In principle, yes, xkcd brings up a valid point. And it's not entirely sound. The entire point of hacking is to not have to get your hands dirty, figuratively speaking, and to obtain far more opportunities for exploitation than what might be had by drugging and torturing someone. After all, one could physically beat a single password out of someone to and find that said password has no value, all while putting one's self at risk of being targeted for committing crimes against humanity. If a password obtained through hacking leads to nothing, it's entirely possible no one will ever know you had it or bother coming after you.
And in this particular subject, placing material on stolen physical media carries a greater risk of being traced back to you than if a purely digital exploit was taken advantage of. It comes with less plausible deniability and a greater risk of getting caught in the act IRL.
In principle, yes, xkcd brings up a valid point. And it's not entirely sound. The entire point of hacking is to not have to get your hands dirty, figuratively speaking, and to obtain far more opportunities for exploitation than what might be had by drugging and torturing someone. After all, one could physically beat a single password out of someone to and find that said password has no value, all while putting one's self at risk of being targeted for committing crimes against humanity. If a password obtained through hacking leads to nothing, it's entirely possible no one will ever know you had it or bother coming after you.
And in this particular subject, placing material on stolen physical media carries a greater risk of being traced back to you than if a purely digital exploit was taken advantage of. It comes with less plausible deniability and a greater risk of getting caught in the act IRL.