'Admittedly hard to see here, but what's happening is this. Keymaster is running in the background. A screenshot is taken. Keymaster has, by this point, already reset the file's permissions to read-only and cleansed the file of all extended attributes. Normally, when Preview opens the screenshot file to save it again to disk, after prompting to have the file 'unlocked' as Keymaster's already been at work on it, there'll be a new shipload of extended attributes. But not now, not with Keymaster running! You can also see - if you look closely in full-screen at the file info sheet - that Keymaster has again reset the file's permissions to read-only (0400).