That means at any time in that period you have the chance to reverse the withdrawal, and if you're hacked it will be a perpetual battle I suppose, but eventually you can ideally either exhaust the hacker and get your withdrawal or take other action, like making it public there is an issue and looking for consensus with witnesses. I'm not exactly sure the best solution in that case but your funds at least will be stuck and this psychologically tells hackers they should just give up on those type of accounts.

The solution in that scenario would be to use the account recovery feature. In that scenario, both you and the hacker have the owner keys, but if you have some other way of identifying yourself (Reddit/Facebook link, a government ID matching the picture in your introduce yourself post, etc.), then your recovery account can use that identify verification to give back full control of the account to you rather than the hacker.