Even if the malware hijacks your session tokens, using something like WebAuthn prevents silent theft of a password, which is much more powerful (allows creation of new sessions).
In most corporate environments that's far more damaging than getting persistence in a handful of webapps.
Also, 2FA solves this exact issue.