One way you could potentially combat that is to make it so that a single short lived token isn't enough to accomplish more dangerous tasks like that. Many site

One way you could potentially combat that is to make it so that a single short lived token isn't enough to accomplish more dangerous tasks like that. Many sites already have some protections against that by for example requiring you to enter your password and/or 2fa code to disable 2fa, change privacy settings, update an email address, etc.