It depends on the threat profile. Something can be "secure from a MITM on the coffee shop wifi" without necessarily being "secure from a directed attack by the NSA".
For any practical security scheme, you do have to make some assumptions about the limitations of your adversary's capabilities. In the extreme case of "attacker has ability to read contents from memory on the end user's machine at will," I'm not aware of any secure cryptographic solution short of memorizing the key and performing all encryption/decryption by hand.
To add to this, there is a time component as well. If your data only needs to be secure for 20 years, it has a different threat profile than one that needs to be secure for 200 years. Then the question becomes "20 years for who?". The safe industry, as an example, thinks about their security problems in this manner.
For any practical security scheme, you do have to make some assumptions about the limitations of your adversary's capabilities. In the extreme case of "attacker has ability to read contents from memory on the end user's machine at will," I'm not aware of any secure cryptographic solution short of memorizing the key and performing all encryption/decryption by hand.