It's a shared computer (and if the session is carrying over, it's not just shared hardware it's a shared account).
In this case - you are utterly fucked if you think that machine is secure. Hell, fuck the session, I'll just run a keylogger (or if I'm not admin, install a malicious browser extension) and capture your whole login - I have considerably more access to this machine than I need to compromise you in a large number of ways.
You could. But what is relevant is whether you have. The point is not to protect against a determined attacker, but to reduce the chance of an opportunistic attack.
It really feels like most people have little experience with shared computer resources any more, because pranking people who left their computer unlocked used to be practically a sport, even when the same people would (mostly) never go out of their way to attack a locked down account.
Screen locks became a thing long before mobile devices for a reason.
Yes they’re overall very exposed to bad actors and the machines they use are really insecure. So, short lease credentials definitely reduces blast radius. If you have a key logger, but no automated account drain scripts, a 5 minute timeout will effectively prevent you unless you’re actively watching.
Finally, some of these are regulatory requirements for better or worse. That doesn’t forgive the regulation, but it does sometimes explain the policy.
Let’s also pretend like there’s a security camera looking at my desk that is usually not monitored, but you don’t know that
Done. Now I have an active session. Don't give a fuuuuck about that 2fa device.
If you already own somebody enough to install whatever malware you want on their computer, then sure, session lengths aren't going to stop you, but they're also not intended to. Session lengths are intended to stop the guy at the coffee shop who grabs your computer when you go to use the bathroom.