Comment by stenius

I know lots of people that have their 2 factor auth setups on the same computer they are using to login. If you can compromise that computer, there's no additional "2fa" needed.

All it takes is some engineer that needs admin access for their job installing something.