What kind of risk profile does one have when it is likely that both the password is known and malware has been installed on the phone, but also just access to a

What kind of risk profile does one have when it is likely that both the password is known and malware has been installed on the phone, but also just access to an ephemeral login session by the attacker (which could be obtained even when using a secure enclave by waiting for the user to authenticate by themselves) would not be enough?