Edit: Also, at some point the employee will be reissued a new key fob for the "broken" one and at that point they will enter their credentials into the network again on that machine giving you access.
Edit 2: I guess a procedure that could prevent this is to require I.T. check the serial number of a fob that has been reported as "broken" thereby verifying there hasn't been a potential intrusion.
And the last time I plugged my keyring key into a computer was a year ago. Most use the nano keys which you never remove from the history device.
Edit: In answer to your response. Yup.
But as far as I can tell, this exploit requires 3-4 zero day exploits to be discovered in a system the attacker has no access to, and to all go undiscovered for an unknown amount of time for while said attacker is exploring.
That's much better than "I can steal user credentials and then download an exploit trivially."