Where is the mnemonic stored when an account is created in MetaMask Extension? Is it stored in LocalStorage or IndexedDB if it is in the browser area?
If the above is the case, the MetaMask Extension allows you to view the recovery phrase permanently, even though it may disappear in a few weeks due to ITP restrictions.
If it is stored on the server, MetaMask can regenerate the private key with the password using MetaMask/KeyringController and generate the private key to be created in the future, which would be a custodial wallet. Do you have permission to do this in the U.S.?
Your MetaMask private key is stored encrypted in your browser data store. As a standalone wallet, MetaMask never gets access to your private keys.
And it’s also impossible to get the user’s private key by packet sniffing, because the private key never leaves the device and is only used for signing.
From reading the implementation, I think the secret key is generated each time using password and mnemonics. So you shouldn’t have the private key directly in the browser area.