While it might be possible to strengthen the mechanism used to keep sessions, the best fix isn't necessarily on that front. They have root access to the device

While it might be possible to strengthen the mechanism used to keep sessions, the best fix isn't necessarily on that front. They have root access to the device you're logged in with, so they can do whatever they want with your current sessions. Auth tokens actually limit the damage by being expirable and being insufficient to perform a new login.