The only difference between the cookie scenario and localstorage scenario here is that you're reading "storage/default/<domain>/ls/data.sqlite"

It's even conveniently grouped by domain

There's no magic hardening going on with local storage (session storage is the same here), it's still SQLite

Even if so, calling ReadProcessMemory/process_vm_readv on another process really doesn't raise alarms that significantly because there are a lot of legitimate programs that do so