I would not make that assumption if they use proper security practices. You can make cookies unusable (or harder to use) by anyone but the initial owner a few

I would not make that assumption if they use proper security practices. You can make cookies unusable (or harder to use) by anyone but the initial owner a few different ways. You could include a hardware or ip fingerprint in the cookie that has to be validated server side, for example. You can time out cookies after an hour. Etc.