The flaw is predictability. Everyone knows that money is stored in a safe. Everyone knows that passwords are stored in a browser. If you are targeted, these are the first places an adversary will check.