You are right. But once you connect, a year later - in those 3 minutes before you disconnect, the attacker might have authenticated as yourself to 100 other ma

You are right. But once you connect, a year later - in those 3 minutes before you disconnect, the attacker might have authenticated as yourself to 100 other machines -- and appended their own key to .ssh/authorized_keys on these machines, so that the compromise no longer needs you to be connected.