The idea behind a man-in-the-browser attack is that the attacker has access to everything that your browser does, at least for the site you are on. This is usually accomplished by tricking your browser into running malicious javascript within the context of the domain you are browsing, but may also be the result of malicious or exploitable plugins. If your browser runs the code that encrypts a key, or uses it to sign something, that means your browser has the unencrypted version of it. In the case of a MITB attack, the attacker has the unencrypted version too. This means it doesn't have to steal the private key after it gets encrypted. It already had it before any encryption.
If your browser has been compromised, nothing you do with it can be considered safe. From a web security standpoint, a MITB attack is about as bad as it gets.