They could also look at your SMS and Email OTP. The secrets in the password vault can be used to authenticate and change settings in various trusted systems, l

They could also look at your SMS and Email OTP. The secrets in the password vault can be used to authenticate and change settings in various trusted systems, like configuring call forwarding. Cloud-based backups or the local filesystem could theoretically be inspected for software TOTP secrets. Responding to the potential for bad user choices and full compromise quickly gets you to the point where your options are separate hardware or requiring in-person confirmation. NIST 800-63-3 AAL3 is probably most appropriate to look at if your risk profile mandates this.