Why are the keys from cryptomator public?

No. You need the password to open your vault.
More information: Why is the masterkey stored in the cloud?

Besides this, since App version 1.6 you can store the Masterkey file anywhere you want as long as it is accessible by the app.