I guess I just can't see the actual path here. How does a token get compromised in a way the victim finds out before the attacker makes ample use of the compromised token? From my pov, when the token gets compromised, you've lost already.

Note the auth systems I create usually do not process payment info and contain very little personal information (an email). I still think I'm fine without revocation mechanisms.