If your host is infected with malware but it can't steal your passwords due to hardware boundaries, it still has access to your host at a pretty reasonable permission level.
In most corporate environments that's far more damaging than getting persistence in a handful of webapps.
Also, 2FA solves this exact issue.
