They may of compromised gmail, because gmail is logged in. They however won't get to the other 20 services that I have not recently logged into recently on the

They may of compromised gmail, because gmail is logged in. They however won't get to the other 20 services that I have not recently logged into recently on the device that also use hardware tokens. They don't get the totp secret for my AWS account which I only log into from that device in emrgencies. Etc. If someone gets remote access to your device it is a very bad day, but you -can- have damage control and a clear picture of what they had access to and what they did not. If the attacker roots your phone and it has your unlocked password manager on it and google authenticator with all the 2fa secrets... well now they get the entire farm, including for services you don't have active cookies for. Hardware tokens are not magic, but they are a very useful tool and if we combine enough tools we make the life of an attacker that much harder.