Comment by perlgeek

Stealing session tokens is a common technique to get around MFA, deployed by malware everywhere.

I don't like it, but frequent reauth does limit the blast radius of stolen session tokens.