Because your master node IP is static, broadcast to the network, and an attacker knows 1000 DRK is on it. Your local machine IP is not listed on the master node list with the 2 machine setup and there are no coins on the server that's running the master node. Double win.
If we could get a port of Armory for Darkcoin you could theoretically do all this with the coins in cold storage. Triple win.
Masternode has to communicate with the node holding the coins, to verify the 1000 DRK are there. So if the masternode can do that, so can an attacker who has compromised the masternode. From there, they just need to break into the secondary node holding the wallet, which will presumably have no better security than the one they already broke into.
My guess is that masternodeA (the one holding the coins) registers in the network like "hey, I want to be a masternode, and I hold 1k DRK, you can check it, and my "masternodeaddr" is this 'masternodeB' (which has 0DRKs)", then the network verifies that masternodeA has 1k DRKs and registers masternodeB in the list of masternodes. When you get the list of masternodes you only get masternodeB.
I guess someone could sniff that initial part of the protocol and find out that masternodeA has 1k DRKs masternodeB has 0 DRKs, but I would say that you don't really even need to have masternodeA available in the network as long as the wallet holds the 1k DRKs, so (and this is just thinking and writing the same time) you could probable even disconnect masternodeA from the network after the initial registration and just leave masternodeB in the network.
If that's how it works, then I wonder why a second machine is necessary? If you only need the wallet present at the initial verification step, why not have a single masternode that verifies the wallet, closes it, and allows you to remove it from the machine?
If it was like this nothing could prevent someone to build thousand masternodes with the same 1000 DRK.
Network would reject a masternode registering twice with the same address, and if you think about moving the 1k DRK to another wallet, network would detect it and stop accepting you as a masternode.