At least for accounts you want to keep very secure, session cookies are probably very time-limited. Stealing a passkey ensures persistent access in the future.

But I largely agree, if they're able to do this on your system you're already hacked and they can do a ton of very bad things.