[ShowalkKama]

or he could simply wait until the employee unlocks his password manager and steal the password?

[MattPalmer1086]

That there exist additional attack vectors is not an argument to ignore one which is simple and requires no user interaction to pull off.

If your point is that password managers aren't a total solution to the issue, I'd agree.