What if the MKR holders are also CDP holders? Then they can manipulate the price feed to make it look like the price of ETH is infinity, and do a global settlement. Without the global settlement, they could withdraw an arbitrarily large amount of DAI and sell it, though revenue from this would be limited as it would quickly crash the market. Alternatively, if the MKR holders were also DAI holders, they could manipulate the price feed down, at which point all of the ETH in the CDPs could be distributed to them.
Though you are right that both attacks are fairly messy, and would not get anywhere close to stealing all of the collateral in the system.