That said, if there isn't already, perhaps there should be a !!!BIG WARNING!!! around leaving it to its own devices... or rather, your devices.
I only access mine from a VM that does just that and I still have to log on every single time.
It is going to be same with malware.
I can't think of a single bank app/site that requires 2FA on every login; most have a "trusted device" option and that cookie becomes your "something you have" second factor for future logins.
This is regardless of it being from a trusted machine or merchant from which you’ve purchased before.
There are probably some cases where this is not true (thinking people without a banking app) but I get the 3D verify for every transaction I make regardless of payment method or vendor.