There is an entire research area called offensive security which includes what is possible and what actions stay undetected. Attacker might be root/admin on thi

There is an entire research area called offensive security which includes what is possible and what actions stay undetected. Attacker might be root/admin on this machine and gaining access to more creds allows the adversary to move to other machines. So in a sense we know its possible but unless someone abuses these things to demonstrate it, organizations won't care or be able to detect compromises and lateral movement. Real world adversaries do these things, most notably was when Google was throughly compromised by a foreign nation state for instance. Also, it gets even more interesting for malware if its running on a bastion host because then malware has access to all the forwarded keys!