Agreed - I've got mixed feelings on it as well. I personally have leaned more towards simply using the posting private key and saving it in the browser, as opposed to giving some entity out there permission to perform actions on my behalf.

In the end though - I don't think using a generic "posting" key or steemconnect are great options. They're just options we have now due to how the account system in steem works - which could use a facelift.