But they must not be requiring it to access these admin systems. Not mentioned in the write up either, surprisingly

I’d imagine they do now… at least for privileged account usage.