[GoblinSlayer]

If the attackers control user machine they will have as much information as the user anyway.

[hannasanarion]

Not if they don't have the passwords and 2FA devices to access company resources from that machine, and all of the sessions are expired.

[GoblinSlayer]

If all sessions expired, then the user doesn't have access to information either - same access as the attacker. There are cached copies of emails too.