If an application uses web storage to keep sensitive information about users, XSS shouldn't be the only security concern. If an attacker has access to the user's computer, this attacker can directly access the files where Local Storage is kept, as browsers save this information in clear text in local database files. It's left to the reader to investigate where these files are stored by different browsers and in different operating systems, and how to read them.